T09 · Insecure Skill Coding Practices
Error
- Location
scripts/court_calendar.py:55- Finding
PowerShell Command Injection Through Document-Derived Calendar and Notification Fields
- Content
View full analysis
- Remediation
View remediation
Security audit
Litigation Hub
Security checks for vulnerabilities and agentic risk
Overview
This skill is a useful litigation document and reminder workflow, but it handles confidential court data through risky email, OCR, HTTP, scheduled-task, and dependency-install paths that need review before installation.
Review before installing. Use only with non-confidential test data until you are comfortable with the risks; avoid the plaintext HTTP court workflow where possible; require explicit approval before OCR, email, browser automation, or dependency installation; pin and locally install dependencies; and restrict or periodically clean ~/.court-email, archives, scheduled tasks, and generated desktop reminder files.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T08 · Insecure Dependencies
Error
- Location
scripts/court_photo_ocr.py:28- Finding
Automatic Unpinned Global npm Package Installation
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:376- Finding
Sensitive Court Access Data and Documents Transmitted Over Plaintext HTTP
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/court_calendar.py:611- Finding
Confidential Case and Reminder Data Stored Without Explicit Restrictive Permissions
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (127)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
该代码块的核心功能是“开庭日历与提醒”：写入 Apple Calendar/Outlook、生成 .ics、设置 launchd/schtasks 定时任务、触发系统通知、生成桌面 Markdown 提醒、安排邮件提醒，以及从 PDF 文本中提取开庭时间地点等信息。这与描述中宣称的完整诉讼信息中枢存在明显落差。尤其是描述强调的输入渠道（法院短信、送达链接、纸质文书照片）、处理能力（OCR、下载、归档、归类）、以及规则能力（12 种期限规则库）在本代码中均未体现。代码确实覆盖了描述中的一部分提醒能力和跨平台支持，但只属于整体描述中的一个子功能，因此描述对该代码而言具有实质性夸大，构成不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
声明描述的是一个较完整的诉讼文书接收、识别、下载、归档与期限提醒的一体化系统；而给出的代码块实际只覆盖“期限规则匹配 + 多渠道提醒”子功能。它不包含短信接收、链接抓取下载、图片 OCR、案卷归档归类等核心能力，因此描述明显超出代码实际行为。此外，描述称支持 macOS / Windows / Linux 全平台，但代码中 Linux 的系统定时任务功能未实现，仅打印“不支持系统定时”，与声明存在实质差异。代码确实实现了日历、系统通知、桌面 Markdown 文件和 QQ 邮件提醒，这部分与描述一致，但整体上仍属于显著描述/行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The description presents a broader end-to-end litigation information system with multi-source intake (SMS, links, photos), deadline-rule matching, and multi-channel reminders. The supplied code chunk implements only one subset: OCRing court document photos/text, extracting structured legal metadata, creating/finding local case folders, and archiving files into standardized directories. It does not ingest SMS, fetch or download from links, compute deadline rules beyond extracting an appeal-deadline number from text, or send any reminders through calendar, email, WeChat, system notifications, or Markdown files. Additionally, the implementation is local-desktop focused and uses Unix-style
which, which weakens the stated full cross-platform claim. Therefore the declared description materially overstates the actual behavior of this code chunk.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents a full litigation-document processing and reminder system. The supplied code chunk does not implement those primary functions. It is a narrow supporting utility for holiday calendar handling and legal deadline adjustment based on workdays. This could be a component of the larger described system, but taken on its own, it materially differs from the declared purpose and lacks the core ingestion, OCR, download, filing, classification, and notification behaviors described.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents a broad end-to-end litigation document processing and reminder system. The supplied code chunk implements only a narrow email-reminder component: it loads prebuilt email content from a local JSON file and sends it through an external SMTP helper, with an additional cleanup mode that deletes those JSON files. While QQ email reminders are mentioned in the declared purpose, this code does not perform the core described functions such as OCR, document intake, downloading, archiving, deadline computation, calendar scheduling, WeChat delivery, or desktop notifications. The cleanup/delete behavior is also not declared. Therefore the code chunk's actual behavior is materially narrower and partially inconsistent with the declared description.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill handles highly sensitive legal case materials yet does not prominently warn that content may be transmitted to external OCR services and email systems. That omission can cause confidential client information, court documents, and case metadata to leave the local machine without informed consent or data-classification checks.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - **提醒生成**：调用 `scripts/court_deadline_reminder.py` 统一设置 日历 + 本机电脑提醒（系统通知 + 桌面 Markdown 文件）+ QQ 邮件（微信送达）
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - **提醒生成**：调用 `scripts/court_deadline_reminder.py` 统一设置 日历 + 本机电脑提醒（系统通知 + 桌面 Markdown 文件）+ QQ 邮件（微信送达）
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - **提醒生成**：调用 `scripts/court_deadline_reminder.py` 统一设置 日历 + 本机电脑提醒（系统通知 + 桌面 Markdown 文件）+ QQ 邮件（微信送达）
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - **提醒生成**：调用 `scripts/court_deadline_reminder.py` 统一设置 日历 + 本机电脑提醒（系统通知 + 桌面 Markdown 文件）+ QQ 邮件（微信送达）
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - **提醒生成**：调用 `scripts/court_deadline_reminder.py` 统一设置 日历 + 本机电脑提醒（系统通知 + 桌面 Markdown 文件）+ QQ 邮件（微信送达）
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - **提醒生成**：调用 `scripts/court_deadline_reminder.py` 统一设置 日历 + 本机电脑提醒（系统通知 + 桌面 Markdown 文件）+ QQ 邮件（微信送达）
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Automatically sending hearing reminders by QQ email can leak confidential case information to external infrastructure without a prominent consent gate. Because the payload includes case number, cause of action, time, and court location, accidental transmission could expose privileged or regulated legal data.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 使用脚本 `scripts/court_calendar.py` 的 `parse` 模式：
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 使用脚本 `scripts/court_calendar.py` 的 `parse` 模式：
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 使用脚本 `scripts/court_calendar.py` 的 `parse` 模式：
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 使用脚本 `scripts/court_calendar.py` 的 `parse` 模式：
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 使用脚本 `scripts/court_calendar.py` 的 `parse` 模式：
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The feature schedules email reminders containing legal case details and states they are sent to a QQ mailbox for WeChat delivery, but the workflow does not present a clear privacy warning or explicit opt-in for data leaving the machine. Given the sensitivity of litigation information, silent external transmission materially increases confidentiality and compliance risk.
- Content
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
python # tags：任一关键词在 tags 列表或文书标题中出现即匹配 if not r_tags: return rule # 无 tags 限制，直接匹配 all_text = ' '.join(tags) + ' ' + doc_title for tag in r_tags:
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
python # tags：任一关键词在 tags 列表或文书标题中出现即匹配 if not r_tags: return rule # 无 tags 限制，直接匹配 all_text = ' '.join(tags) + ' ' + doc_title for tag in r_tags:
Env Variable Harvesting
High
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
- Content
python body = data.get('body', '') # 清理系统代理环境变量，避免影响本地 SMTP 连接 env = os.environ.copy() for key in ['HTTP_PROXY', 'HTTPS_PROXY', 'http_proxy', 'https_proxy', 'no_proxy']: env.pop(key, None) env['NO_PROXY'] = '*'
Env Variable Harvesting
High
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
- Content
python body = data.get('body', '') # 清理系统代理环境变量，避免影响本地 SMTP 连接 env = os.environ.copy() for key in ['HTTP_PROXY', 'HTTPS_PROXY', 'http_proxy', 'https_proxy', 'no_proxy']: env.pop(key, None) env['NO_PROXY'] = '*'
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The changelog explicitly states that the system stores the full API response, including fields such as court name, court identifiers, timestamps, and document arrays, into archive JSON. In a litigation-processing skill, those responses can contain highly sensitive case metadata and personal information; storing them by default without an explicit warning, minimization strategy, or retention controls materially increases confidentiality and compliance risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The changelog says the original SMS content is archived, which may include delivery links, verification codes, case numbers, party names, phone numbers, and other sensitive litigation data. In this skill's context, preserving raw SMS text creates a concentrated source of secrets and personal data that could be exposed through local compromise, sync/backup leakage, or accidental sharing.
- Content
Static analysis
No suspicious patterns detected.