ClawHub
Back to skill

Security audit

LegalAid

Security checks across malware telemetry and agentic risk

Overview

This is a coherent legal-rights drafting and guidance skill, but users should be careful about sharing sensitive case details.

Before installing, treat this as drafting and reference support rather than legal representation. Share only the minimum facts needed, redact unnecessary ID numbers, addresses, phone numbers, medical records, account details, and third-party personal data, and verify generated legal citations or filings with current official sources or a qualified professional for high-stakes matters.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
This skill is explicitly designed for legal-rights disputes, evidence organization, complaint/report generation, and litigation preparation, which naturally involves highly sensitive personal, financial, medical, employment, and case-related data. The README encourages broad use but does not warn users to minimize, redact, or locally handle sensitive information, increasing the risk of unnecessary disclosure to AI platforms, logs, or third-party integrations.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The README tells users to copy the entire SKILL.md into a third-party AI chat as a system prompt, but it does not warn that subsequent case facts, evidence summaries, and legal documents may be transmitted to external model providers and retained in logs. In the context of a legal-aid skill, this is especially sensitive because users may share dispute records, personal identifiers, medical or employment evidence, and draft filings.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The activation keywords are very broad and include common terms like 投诉, 举报, 起诉, 证据, and 调解, which can appear in many ordinary discussions. This can cause unintended auto-activation of the skill, leading the agent to switch into legal-guidance mode prematurely and potentially deliver procedural or quasi-legal advice in contexts where the user did not request it.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The templates repeatedly instruct users to include highly sensitive personal data such as身份证号码、住址、联系电话、病历资料、保单号 and other evidence materials, but they do not warn about data minimization, redaction, storage, or safe transmission. In a legal-aid skill, users are likely to paste real case details, so omission of privacy safeguards can directly increase the risk of oversharing, accidental disclosure, and secondary privacy harm.

VirusTotal

53/53 vendors flagged this skill as clean.

View on VirusTotal