Security audit

lunheng

Security checks for vulnerabilities and agentic risk

Overview

This legal drafting skill mostly matches its stated purpose, but it handles confidential case data and API credentials with enough under-scoped controls that users should review it carefully before installing.

Install only in an isolated virtual environment, avoid `--break-system-packages`, and use a dedicated low-privilege API key. Before processing real cases, verify `LH_LLM_BASE_URL` points to a trusted HTTPS provider or use explicit local mode, redact personal and confidential details, do not expose the REST server beyond loopback, and treat stderr/process logs as potentially containing case information.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/pipeline.py:91
Finding: Sensitive Legal Case Data Is Written to Process Logs
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/config.py:28
Finding: Confidential Case Data and API Credentials Can Be Sent to an Unrestricted Endpoint
Content: View full analysis
str: """根据模式解析实际的 API 地址""" if self.local: # 本地模式（Ollama/vLLM）：全部走本地 return self.base_url if self.zero_retention: # 零留存模式：使用独立端点（需 provider 支持） return os.environ.get("LH_LLM_ZR_URL", self.base_url) return self.base_url ``` ```python headers = {"Content-Type": "application/json"} if not self.local: headers["Authorization"] = f"Bearer {self.api_key}" body = json.dumps({ "model": self.model, "messages": messages, "temperature": temperature, "max_tokens": max_tokens, }).encode("utf-8") req = urllib.request.Request( f"{self.resolved_base_url}/chat/completions", data=body, headers=headers, method="POST", ) try: resp = urllib.request.urlopen(req, timeout=timeout) ``` The drafting prompt includes case-sensitive fields: ```python prompt_sections = [ "你是一位资深法官,擅长撰写高质量裁判文书。请根据以下材料撰写一份民事判决书。", "", "## 案件信息", f"案由: {elements.cause}", "当事人:", parties_str, f"诉讼请求: {', '.join(elements.claims[:5])}", f"关键事实: {', '.join(elements.facts[:8])}", f"争议焦点: {', '.join(elements.disputes[:4])}", f"法律问题: {', '.join(elements.legal_issues[:4])}", f"适用法条: {', '.join(elements.applicable_laws[:4])}", f"证据: {', '.join(elements.evidence[:5])}", ] ``` ### Technical Analysis Remote LLM processing is part of the declared ...[truncated 2372 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/server.py:58
Finding: Unauthenticated Loopback API Permits Resource Exhaustion and Unauthorized LLM Usage
Content: View full analysis
0 else b"" return json.loads(raw) if raw else {} ``` ```python server = HTTPServer(("127.0.0.1", PORT), JudgmentHandler) ``` ### Technical Analysis Binding to `127.0.0.1` appropriately limits direct remote-network exposure, but it does not provide authentication. Any process running under any local account that can connect to the port can invoke `/api/draft` and `/api/parse`. The server accepts the caller-provided `Content-Length` and reads that entire amount without enforcing a maximum. It also lacks rate limiting, per-client quotas, operation quotas, and an authorization token. Draft requests can invoke parsing, retrieval, judgment generation, and other potentially expensive LLM operations. The CORS allowlist is not an authentication mechanism. It affects compliant browser scripts but does not restrict native local clients, malware, command-line tools, or other processes. Requests without an `Origin` header can still reach the handlers. Becaus ...[truncated 1348 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:41
Finding: Unpinned Dependencies Are Installed into the System Python Environment
Content: View full analysis
=3.10" dependencies = [] ``` ### Technical Analysis The installation instructions resolve mutable, unpinned versions of `rapidfuzz` and `pdfplumber` from the user's configured Python package index. No version constraints, lock file, or cryptographic hashes are provided. The use of `--break-system-packages` bypasses protections intended to prevent pip from modifying a distribution-managed Python environment. This can overwrite or conflict with operating-system packages and makes installation state difficult to reproduce or audit. No evidence was found that the named packages are typosquatted or currently malicious. The security issue is exposure to future package compromise, dependency drift, unsafe index configuration, and system-package conflicts rather than a confirmed malicious dependency. ### Attack Path 1. A user follows the prerequisite instructions. 2. Pip connects to the configured package index and resolves the latest available versions and transitive dependencies. 3. A compromised package release, compromised index, maliciously configured mirror, or future dependency takeover supplies altered code. 4. Pip installs that code into the system-managed Python environment because `--break-system-packages` is enabled. 5. Package installation hooks or subsequently imported modules execute with the privileges of the user running pip. 6. The altered environment may also affect unrelated system applications that share the same Python installation. ### Impact Assessment The potential privilege scope equals the privileges of the account running pip. If the command is run with administr ...[truncated 481 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (137)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The supplied code largely supports part of the declared purpose—drafting judicial documents using templates, retrieval context, and LLM-assisted reasoning. It includes similar-case/law/pattern references and some syllogistic-style reasoning prompts, so there is meaningful alignment on document generation. However, several prominent declared capabilities are absent from this chunk: no citation verification engine, no reasoning quality scoring, no sentencing calculation, no batch processing, and no built-in HTTP API server. Additionally, the implemented fee calculation is for civil case filing fees, which is materially different from sentencing calculation. Therefore the description overstates and partially misrepresents what this code chunk actually does, making this a mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description presents a legal AI assistant focused on adjudicative writing and analysis features. In contrast, the actual code chunk only implements offline data-quality cleaning for local case JSON files under data directories. It scans for corruption markers, infers legal domain from keywords, removes certain cross-domain contaminated cases, rewrites the source files, and prints a summary report. This is a materially different primary purpose from the declared assistant capabilities. While data cleaning could be a supporting internal maintenance task, the code shown does not implement or directly expose any of the core declared functions, and it performs an undeclared capability of modifying local datasets.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The supplied code does not implement the declared legal-assistant behaviors such as judicial document drafting logic, three-part legal reasoning, statute verification, scoring, sentencing calculation, case-type coverage, batch processing, or case retrieval. Instead, it is an infrastructure module for configuration management and forwarding chat requests to an LLM provider over HTTP. While such a proxy could support the larger product, the chunk’s actual purpose is materially different from the declared end-user functionality, and it introduces undeclared network/API-routing capability. This is more than a mere supporting detail because the code shown is solely transport/config plumbing rather than the described legal reasoning functionality.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The description presents a broad AI judicial writing assistant with many capabilities, including drafting, legal citation verification, reasoning scoring, sentencing calculation, HTTP API service, and batch processing. The supplied code, however, is focused on one specific subsystem: checking consistency of a draft verdict against similar cases. It retrieves similar cases, extracts and compares amounts, heuristically checks outcome direction, generates warnings, and outputs a report through a CLI. This partially overlaps with the declared '类案检索' aspect, but most of the headline capabilities are absent from this code chunk. Because the actual code's primary purpose is materially narrower and different from the declared end-user description, this should be flagged as a description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents the skill as a full legal AI assistant with substantive legal-analysis and document-generation capabilities. This code chunk does not implement any of those end-user functions; instead, it serves as an auxiliary setup utility for obtaining supporting datasets. While such a downloader can be a legitimate supporting component of the overall project, the requested task is to compare the description against this supplied code chunk. For this chunk, the primary behavior is data acquisition/checking via filesystem and HTTP, which is not described in the declared purpose. Therefore this chunk materially differs from the declared functionality and should be flagged as a mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The declared description presents a broad legal writing/judgment-assistant system with multiple advanced capabilities centered on drafting, reasoning, verification, scoring, sentencing, retrieval, and service interfaces. The supplied code chunk does something narrower and different: it parses structured case elements from free-text case descriptions via an LLM call or regex heuristics, with a command-line interface. While this parser could be a supporting component of a larger legal assistant, the chunk itself does not implement the core declared functions. The only partial overlap is that it handles legal case text and extracts applicable laws, but even that is heuristic extraction rather than citation verification. Therefore the description materially overstates and misrepresents what this code actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a domain-specific legal AI assistant with substantial judicial-document and legal-analysis capabilities. The actual code chunk is a support module for reliability and validation, not a legal writing or analysis engine. While utility modules like logging/retry can legitimately support a larger system, this specific chunk does not itself implement or evidence the declared primary purpose. Therefore, based on description-versus-behavior for the supplied code chunk, there is a material mismatch: the code is generic infrastructure rather than the advertised legal-assistant functionality.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description presents a broad AI adjudication-writing assistant with analytical and generative capabilities: syllogistic reasoning, document drafting/modification/polishing, statute citation verification, scoring, sentencing calculation, API service, and retrieval features. The supplied code does something materially different: it is an offline extraction utility for a specific set of PDFs named 《双百优秀裁判文书的形与神》. It reads local PDF files, extracts text/tables, parses TOC entries and sections, and serializes the results into JSON. This is a data-ingestion/preprocessing script, not an AI assistant implementation. While extracted materials could potentially support a larger legal-writing system, this chunk itself does not implement the core declared behaviors, so the description does not accurately represent the code shown.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a broad AI legal writing/judgment-assistance system with multiple advanced capabilities. The supplied code instead implements a specific fee calculator for litigation costs, based on statutory brackets and reduction rules, plus CLI and formatting helpers. While this is legal-domain functionality, it is materially different from the declared primary purpose and omits nearly all advertised capabilities. Therefore the description does not accurately represent what this code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description presents a broad, feature-rich legal AI assistant with substantive analysis, validation, retrieval, scoring, calculation, and service capabilities. The supplied code does not implement those core functions. Instead, it is narrowly a formatter: it takes a preexisting draft object and serializes it into text/Markdown/HTML/DOCX with presentation logic and styling. It does not perform legal reasoning, citation checking, scoring, sentencing, API serving, or batch orchestration. While it includes sections for retrieved cases, laws, patterns, and warnings, it merely formats data that must have been produced elsewhere. Therefore, the supplied code chunk does not accurately represent the declared purpose and is materially narrower in functionality.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The description presents a comprehensive AI legal writing assistant with multiple advanced functions. The supplied code, however, only implements one narrow component: rule/keyword-based routing of likely applicable laws for a given cause of action, plus law-alias resolution and a CLI interface. While this partially overlaps with the declared '法条引用' area, it does not implement verification, document generation, scoring, sentencing, retrieval, HTTP service, or other major advertised capabilities. Because the actual code’s primary behavior is much narrower and materially different from the broad declared purpose, this is a mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The code chunk does not implement an AI裁判文书写作助手 or the listed major capabilities such as syllogistic reasoning, document drafting/modification/polishing, reasoning scoring, sentencing calculation, 74 case-type coverage, batch processing, similar-case retrieval, or an HTTP API service. Instead, it is a focused scraper/client for the Ministry of Justice administrative regulations library. While the declared description mentions legal citation verification, this code only supports one narrow part of that area: checking and retrieving administrative regulations from a specific source. The code’s primary purpose is therefore materially narrower and different from the declared overall skill description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The supplied code chunk is narrowly focused on querying the 国家法律法规数据库 (flk.npc.gov.cn). It performs POST/GET HTTP requests to search laws, retrieve law details, verify a law's existence/status, and recursively count article-like sections. This partially overlaps with the declared '法条引用核查' idea, but it does not implement the broader advertised functionality of an AI judicial-writing assistant: there is no document generation, editing, polishing, legal reasoning, scoring, sentencing logic, case-type handling, class-case retrieval, batch processing, or server/API hosting behavior. The primary purpose of the code is legal database lookup, which is materially narrower and different from the declared end-user skill description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The declared description presents a comprehensive judicial document writing assistant with drafting, polishing, legal citation verification, scoring, sentencing, API service, batch processing, and similar-case retrieval. However, this code chunk specifically performs upstream information extraction: it parses free-text case descriptions into structured elements. While this is related to legal-assistant workflows, it is a materially different primary purpose from judgment writing itself. Additionally, the code makes outbound network requests to an external LLM endpoint via urllib.request using API credentials, which is an undeclared capability given the empty permissions declaration. Most headline features in the description are not implemented in this chunk. Although not every feature must appear in every file, the chunk’s concrete behavior is narrower and different enough—especially the undeclared external HTTP access—to warrant a mismatch finding.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The code substantially matches the core declared purpose of a legal judgment-writing assistant: it parses case elements, generates a draft using syllogistic-style assembly, scores reasoning quality, optionally enhances the draft, retrieves similar cases, analyzes divergence, and can calculate sentencing suggestions. However, several materially declared capabilities are not represented in this supplied code chunk. There is no HTTP API server implementation, no batch-processing logic, and no explicit statute-citation verification mechanism (let alone a 'three-layer verification' workflow). The claim of covering 74 case types is also not supported by this chunk. Since the description presents these as built-in capabilities, but the code shown is only a pipeline/CLI orchestrator without those features, this is a partial description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The declared description presents a broad AI adjudicative writing assistant with generation, revision, legal citation verification, sentencing calculation, retrieval, and service capabilities. The supplied code chunk is much narrower: it performs regex/fuzzy-rule-based quality inspection of judicial documents and formats the resulting report. While one claimed feature loosely overlaps—'reasoning quality scoring'—the implementation only provides heuristic document quality checks and a computed score, not the larger assistant behavior described. The code does not access undeclared sensitive resources and the CLI trigger is not inherently problematic, but the primary purpose and most advertised capabilities are absent from this chunk. Therefore the description does not accurately represent what this code actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The description presents a comprehensive AI legal-document assistant with multiple major capabilities and infrastructure features. The supplied code chunk only implements one narrow component: sentencing recommendation calculation based on hardcoded offense categories, severity labels, and adjustment factors, plus report formatting and CLI argument parsing. There is no evidence of document generation/editing, legal citation verification, reasoning evaluation, HTTP service, batch workflows, or retrieval functionality. While '量刑计算' is indeed included in the declared description, the actual code is materially narrower than the declared primary purpose and lacks most headline capabilities, so the description does not accurately represent this code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: 声明描述的是一个功能全面的AI司法文书写作与审查系统；但提供的代码块只是一个本地案例资料检索脚本，主要围绕JSON/PDF中的案例目录、关键词、摘要、全文提取和写作心得浏览。它没有任何生成式写作、分析评分、法条校验、量刑计算、HTTP服务或批处理逻辑。虽然“类案检索”与“说理深度增强”中的一小部分可勉强对应到案例搜索和写作心得提取，但这只是整体声明中的很小子集，且代码的主要目的明显不同。因此描述与实际行为存在实质性不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 89% confidence
Finding: The description presents a comprehensive judicial writing assistant with multiple substantive capabilities. The actual code chunk is much narrower: it retrieves exemplary writing samples from local data sources and formats them as reference material for LLM prompts. While this could support document writing and 'reasoning depth enhancement' as an internal helper, it does not itself perform most of the headline functions claimed in the description, such as legal citation verification, scoring, sentencing calculation, API serving, or batch operations. Therefore the supplied code does not accurately represent the declared broad functionality and shows a materially different, more limited primary purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description describes a feature-rich legal AI assistant for drafting and analyzing judicial documents. However, the supplied code chunk does not implement any of those capabilities. It only adjusts Python's import path for tests during pytest execution, which is a development/testing support function rather than part of the declared legal assistant behavior. This is a materially different primary purpose for the provided code chunk, so it should be flagged as a mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description presents a full-featured legal AI assistant. However, the supplied code chunk contains only shared test fixtures: example case narratives and verdict strings, plus a sys.path modification for tests. This is not merely a partial implementation detail of the claimed features; in this chunk, there is no substantive assistant behavior at all beyond test data setup. Therefore the code does not accurately represent the declared functionality, and the mismatch should be flagged.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The supplied code is narrowly focused on parser unit tests, specifically regex fallback extraction from case text. Its observable behavior is limited to validating parsing helpers such as cause detection, party extraction, claim extraction, and a CaseElements data structure. That is materially different from the declared product description, which emphasizes a full-featured AI judicial document writing assistant with legal analysis, citation checking, scoring, sentencing, API service, and retrieval capabilities. While parser functionality could be a supporting component of such a system, this code chunk itself does not demonstrate those declared primary capabilities and instead reflects a different immediate purpose: testing text parsing behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The declared description presents a broad end-user legal writing assistant with many capabilities. The supplied code chunk, however, is only a test module for one subcomponent: legal citation extraction and validation. It does support part of the declared feature set—statute citation verification, including local validation, repealed-law detection, and fuzzy matching—but it does not demonstrate most of the assistant’s stated primary functions. Because the actual code shown is materially narrower in purpose and lacks evidence for the major declared capabilities, the description is not an accurate representation of what this code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The declared description presents a comprehensive legal writing assistant with many high-level capabilities. The supplied code, however, is only a test module validating a law_router component: exact/fuzzy cause matching, keyword-based law suggestion, alias resolution, deduplication, fallback behavior, and formatted display. These behaviors relate only tangentially to legal assistance and do not substantiate the major declared capabilities such as document drafting, legal reasoning, citation verification, scoring, sentencing, HTTP API service, batch processing, or case retrieval. Because the actual code's primary purpose is materially narrower and different from the declared skill description, this is a mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description presents a broad, feature-rich judicial writing assistant. The actual code shown is narrowly focused on testing a document quality-checking function, mainly around format/completeness/error scoring for verdict text. Some overlap exists with the declared '说理质量评分' / quality assessment aspect, but the chunk does not demonstrate most of the advertised core capabilities, and its primary purpose appears to be unit testing a quality checker rather than implementing a full AI judicial document assistant. Therefore this is a material description-behavior mismatch based on the supplied code chunk.
Content: No source excerpt is available for this finding.