Litigation Hub

• Outcome: Review
• Latest audit: Jul 13, 2026 · 1:47 PM UTC
• Version: 2.2.3

Overview

This legal-document automation skill is mostly purpose-aligned, but it grants broad local, network, email, installation, and persistent reminder authority with several consent and scoping gaps.

Review before installing. This skill is intended for sensitive litigation workflows and may install global npm tools, download court documents, write case files and raw OCR/SMS data locally, create calendar entries and OS scheduled tasks, place reminders on the Desktop, and send case reminders by email. Use it only on a trusted machine, prefer preinstalling and pinning dependencies yourself, configure a secure case folder and email recipient, and require explicit confirmation before installs, browser automation, existing-folder writes, reminder creation, or any email transmission.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (49)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

f'  end tell\nend tell')
    f = tempfile.NamedTemporaryFile(mode='w', suffix='.scpt', delete=False, encoding='utf-8')
    f.write(script); f.close()
    r = subprocess.run(['osascript', f.name], capture_output=True, text=True)
    os.remove(f.name)
    if r.returncode == 0:
        print(f"  📅 Apple Calendar: {summary}")

• Confidence: 83% confidence
• Finding: The script dynamically generates AppleScript containing user-derived summary/description data and executes it with osascript. Although some quote escaping is attempted, script-generation bugs can still lead to AppleScript injection or unintended calendar manipulation if crafted input breaks the generated script.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

tr = f'"{python_exe}" {" ".join(f"{a}" for a in args)}'
    cmd = ['schtasks','/Create','/SC','ONCE','/TN',label,'/TR',tr,
           '/ST','09:00','/SD',alarm_date.strftime('%Y-%m-%d'),'/F']
    r = subprocess.run(cmd, capture_output=True, text=True, timeout=15)
    if r.returncode != 0:
        print(f"  ⚠️ schtasks 失败: {r.stderr}"); return False
    print(f"  ✅ schtasks: {label} → {alarm_date.strftime('%Y-%m-%d')} 09:00")

• Confidence: 84% confidence
• Finding: The Windows scheduled task command string is built by concatenating untrusted args into the /TR field, which schtasks will later execute. Because case-derived values can influence arguments, improper quoting can cause argument injection or malformed task actions on Windows.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

script = f'display notification "{m}" with title "{t}"'
        f = tempfile.NamedTemporaryFile(mode='w', suffix='.scpt', delete=False, encoding='utf-8')
        f.write(script); f.close()
        subprocess.run(['osascript', f.name], capture_output=True)
        os.remove(f.name)
    elif PLATFORM == 'windows':
        t = _escape_ps(title); m = _escape_ps(message)

• Confidence: 86% confidence
• Finding: The macOS notification path writes a temporary AppleScript file with user-influenced title/message content and executes it. Incomplete escaping can permit AppleScript syntax breakage and unintended execution behavior, especially when inputs originate from OCR or parsed document text.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

elif PLATFORM == 'windows':
        t = _escape_ps(title); m = _escape_ps(message)
        ps = f'Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.MessageBox]::Show("{m}","{t}")'
        subprocess.run(['powershell','-NoProfile','-Command',ps], capture_output=True)


# ============================================================

• Confidence: 78% confidence
• Finding: This PowerShell command embeds user-influenced strings directly into a -Command expression. The helper escapes quotes and newlines, but PowerShell has additional parsing behaviors, so crafted content can still produce command/argument injection or script breakage.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def _install_mineru():
    """自动安装 mineru-open-api"""
    print("📦 正在安装 MinerU OCR（仅首次需要，约需 30 秒）...", file=sys.stderr)
    r = subprocess.run(['npm', 'install', '-g', 'mineru-open-api'],
                       capture_output=True, text=True, timeout=120)
    if r.returncode != 0:
        print(f"❌ MinerU 安装失败: {r.stderr}", file=sys.stderr)

• Confidence: 98% confidence
• Finding: The script automatically performs a global npm install of an external package at runtime, which executes untrusted code from the npm ecosystem on the host. In this skill’s context, the host may contain sensitive court documents and legal data, so a compromised package, typo-squatted dependency, or manipulated registry response could lead to code execution and data exfiltration.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if not _install_mineru():
            return None

    result = subprocess.run(
        ['mineru-open-api', 'flash-extract', image_path],
        capture_output=True, text=True, timeout=120
    )

• Confidence: 92% confidence
• Finding: The script invokes an external OCR CLI on attacker-controlled input files, which crosses a trust boundary and can expose the host to vulnerabilities in the third-party OCR tool or its parsers. Because the skill is designed to process court document photos from outside sources, a crafted image could trigger exploitation in the OCR binary and compromise a workstation holding confidential legal records.

Tainted flow: 'cmd' from os.environ.get (line 129, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow

Content

tr = f'"{python_exe}" {" ".join(f"{a}" for a in args)}'
    cmd = ['schtasks','/Create','/SC','ONCE','/TN',label,'/TR',tr,
           '/ST','09:00','/SD',alarm_date.strftime('%Y-%m-%d'),'/F']
    r = subprocess.run(cmd, capture_output=True, text=True, timeout=15)
    if r.returncode != 0:
        print(f"  ⚠️ schtasks 失败: {r.stderr}"); return False
    print(f"  ✅ schtasks: {label} → {alarm_date.strftime('%Y-%m-%d')} 09:00")

• Confidence: 82% confidence
• Finding: The /TR payload for schtasks is built as a single command string and includes arguments influenced by upstream case data. That makes this a more credible injection surface than the email case, because Windows task execution will later parse the string and may mis-handle crafted quotes or separators.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill declares no permissions while explicitly requiring environment access, file read/write, and shell execution throughout the workflow. This creates a misleading trust boundary: operators may approve the skill believing it is passive documentation, while it is actually designed to manipulate local files, invoke system tooling, install packages, and make network requests.

Context-Inappropriate Capability

Medium

• Confidence: 79% confidence
• Finding: The Playwright MCP/browser automation guidance expands the skill from document processing into generalized browser control, including navigation, code evaluation, and downloads. In a high-trust local agent context, browser automation materially increases the attack surface because it can interact with arbitrary pages, handle authentication flows, and exfiltrate retrieved data if later misused.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill states that global packages such as mineru-open-api and Playwright may be installed automatically and 'without user awareness'. Silent installation of executable tooling changes the host environment, increases supply-chain risk, and can introduce unexpected persistence or privileged capabilities beyond ordinary document handling.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The document promises reminder confirmation before creation, but other sections describe automatic reminder setup as part of normal processing. This inconsistency is security-relevant because it can lead to unauthorized calendar entries, notifications, scheduled tasks, and outbound emails being created without the expected approval checkpoint.

Intent-Code Divergence

Medium

• Confidence: 82% confidence
• Finding: The skill says existing case folders must never be written without lawyer confirmation, yet later workflow text describes automatic filing progression. In a litigation context, inconsistent write rules can cause misfiling into the wrong client matter, contaminating case records and potentially exposing confidential documents across matters.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The script installs OS-level scheduled tasks via launchd/schtasks, creating persistent automation on the host. In an agent-skill context this is security-relevant because the skill modifies host execution state beyond a one-time reminder and can continue running later without a fresh user action.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The script’s documented purpose is OCR and parsing, but it silently expands its authority by installing software globally on the system. That behavior increases attack surface and violates user expectations; in a legal-document workflow, this makes compromise of the operator workstation materially more dangerous because the machine likely stores privileged case materials.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The script advertises email sending, but also exposes a separate deletion path via --cleanup that removes files from the application's data directory. Hidden destructive capabilities increase the chance of accidental or unauthorized data loss, especially when the script may be invoked by automation or other tooling that assumes it is send-only.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: Describing automatic dependency installation as occurring 'without user awareness' is itself unsafe behavior for an agent skill. It authorizes silent execution of package managers and network retrieval of code, which is especially risky on a host handling sensitive legal records.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill sends reminders via QQ email/WeChat delivery while processing highly sensitive legal matter data, yet lacks a prominent privacy and data-sharing warning. External transmission of case numbers, parties, hearing times, and courts can expose confidential client information to third-party email infrastructure and downstream notification channels.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The archive format explicitly stores full raw SMS content, delivery links, extracted URL parameters, court metadata, party names, case numbers, and deadline data in JSON. In this litigation context, that creates a concentrated store of highly sensitive legal and personal data that could expose confidential case information, enable unauthorized document retrieval, or leak identifiers if the archive is accessed, synced, or backed up insecurely.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The script performs side effects including creating calendar entries, writing files to the desktop and ~/.court-email, and registering scheduled tasks/LaunchAgents without a strong user-facing confirmation step at execution time. In a skill that processes externally supplied court messages and documents, silent local persistence and reminder setup increases the chance of unwanted system modification or abuse through crafted inputs/workflows.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The reminder setup persists sensitive case metadata to local JSON files and later writes reminder content to desktop Markdown files, but the interface does not prominently warn the user first. In a litigation workflow,案号、案由、法院、期限等信息 are sensitive and local disclosure to other desktop users or backup/sync tools is a real privacy risk.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill emails case reminder content through an external SMTP helper without a clear privacy warning or consent gate. Because the content includes litigation details and deadlines, accidental transmission to third-party mail infrastructure or a misconfigured recipient can expose confidential legal information.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script writes OCR-extracted court text to disk by default, creating persistent local storage of potentially sensitive personal and case information without explicit consent or warning. In litigation workflows this may include names, IDs, hearing details, and other confidential legal data, increasing the risk of unauthorized local disclosure, backup leakage, or mishandling.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The function persists case-related reminder content directly to the user's Desktop, which is a highly visible and commonly synced location, increasing the chance of accidental disclosure to other local users, shoulder-surfing, screen sharing, backup systems, or cloud sync services. In this litigation context, reminder titles and lines may contain sensitive court, client, or deadline information, and the interface/comments do not clearly communicate this privacy impact or require explicit opt-in.

Missing User Warnings

Medium

• Confidence: 80% confidence
• Finding: Cleanup mode performs immediate file deletion with no confirmation, dry-run, or warning, making accidental data loss plausible if the flag or identifier is mistyped or misused. In a litigation-reminder system, deleting queued reminder data can cause missed notifications and operational harm.

External Transmission

Medium

• Category: Data Exfiltration

Content

# 3. 解析文书列表，逐个下载 PDF
echo "$resp" | jq -r '.data[] | "\(.c_wsmc)\t\(.wjlj)"' | while IFS=$'\t' read -r name url; do
  curl -sL -o "/tmp/court-sms-staging/${name}.pdf" "$url"
done

# 4. 验证下载结果

• Confidence: 90% confidence
• Finding: The skill downloads documents from external URLs and later also transmits reminder data through email channels. External network transfer is expected for court document retrieval, but it is still a real data-flow risk because the downloaded content and derived metadata are sensitive legal materials and may be fetched from or routed through third-party systems.

Static analysis

No suspicious patterns detected.