Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent Chinese contract-review tool, but it can send sensitive contract contents to an external AI service through broad auto-triggers without clear consent or privacy controls.
Only use this skill with contracts you are allowed to send to the configured AI provider. Avoid broad auto-trigger use for confidential documents, redact sensitive terms before review, do not use untrusted config files, and have a qualified human review the output before relying on it legally or commercially.
scripts/contract_analyzer.py:107Unrestricted Prompt Template Path Enables Local File Disclosure to an External AI Service
scripts/contract_analyzer.py:83Untrusted Contract Content Can Perform Indirect Prompt Injection
The skill documentation says contract uploads or simple requests automatically trigger review, but it does not clearly warn that the full contract text will be transmitted to an external AI API. Contracts often contain confidential, privileged, or regulated data, so silent exfiltration to a third-party model provider creates a significant privacy and confidentiality risk.
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
focus_areas_text = '\n'.join(f'- {area}' for area in focus_areas)
return prompt_template.format(
contract_text=contract_text,
focus_areas=focus_areas_text
)
The document presents the skill as a Chinese contract review skill and states the documentation is fully in Chinese, but it does not explicitly offer a language choice or explain a necessary organizational or regional constraint. This can violate language/locale policy when a skill imposes a specific language without user opt-in.
The quickstart instructs users to analyze contract files via an external API but does not warn that sensitive contract contents may be transmitted off-device to a third-party model provider. Contracts commonly contain confidential business, personal, and legal data, so omission of a privacy/data-handling warning can lead to unintended disclosure and compliance issues.
The README presents the tool as a Chinese contract review tool and all user-facing instructions are in Chinese, with no indication that users can choose another language or that the locale restriction is an intentional, justified regional constraint. This creates a natural-language locale policy concern because the skill appears to enforce a specific language without opt-in.
The invocation phrases shown in the README are very broad, everyday-language requests such as '让我审合同' and '让我出修订对照表'. In an agent environment, overly generic triggers can cause accidental activation during normal conversation, leading the skill to process user files or requests when the user did not explicitly intend to invoke this specific tool.
The skill is explicitly branded and described as a Chinese contract review tool, and the documentation consistently assumes Chinese usage without indicating that language selection is optional. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is clearly justified as region-specific.
The skill claims it will auto-trigger on vague phrases like "让我审合同", "让我出修订对照表", or merely uploading a contract file. Because the skill sends contract contents to an external AI model, broad trigger conditions can cause users to invoke it unintentionally and disclose sensitive legal or commercial information without clear, informed consent.
The module docstring and user-facing strings present the skill as a Chinese contract review capability only, with no indication that users may choose another language or that the Chinese-only scope is an explicitly justified policy exception. This is a natural-language locale constraint visible in the file and matches the language/locale policy violation criteria.
The file description and generated report/prompting are explicitly fixed to Chinese-language contract review (中文合同审查, 中国合同审查专家) with no visible opt-in or language selection mechanism. Under the stated policy, forcing a specific language or locale without user choice is a natural-language policy violation unless clearly justified as region-specific.
Untrusted contract text is interpolated directly into the prompt as plain instructions, so adversarial text inside the contract can influence the model's behavior, override review goals, or manipulate the analysis output. In this skill's context, that can suppress risk findings, inject misleading legal advice, or cause downstream reports to contain attacker-controlled conclusions.
The analyzer sends full contract contents to an external LLM service without explicit disclosure, consent flow, or any visible privacy controls. Because contracts often contain confidential commercial terms and personal data, this can cause unintended third-party disclosure and compliance issues if users assume processing is local.
The module docstring states this is a 'PDF parser' that supports extracting text from PDF files. However, the implementation goes beyond parsing by extracting contract sections such as parties, obligations, payment terms, liabilities, termination, and dispute resolution in lines L089-L234, which is a materially broader purpose than the documentation claims.
The module description and user-facing strings are entirely in Chinese and describe the skill specifically as a Chinese contract review tool. This creates a language/locale constraint without offering user choice or documenting why the restriction is required, which matches the language policy violation criteria.
The code prints full extracted PDF contents directly to stdout, which can expose sensitive contract data in logs, terminals, CI output, or shared execution environments. In the context of contract review, PDFs are likely to contain confidential business, legal, or personal information, making unintended disclosure materially risky.
The module docstring states this is a 'Word parser' that supports extracting text from DOCX files. However, the implementation also includes multiple routines to identify and extract contract-specific sections such as parties, payment terms, liabilities, termination, and dispute resolution, which is broader semantic analysis rather than simple parsing.
The class docstring says only 'Word document parser', and the primary parsing methods are documented as extracting text. Yet the class contains dedicated contract-review helpers keyed to legal concepts and party labels, indicating a narrower and more opinionated behavior than the documentation claims.
The function prints extracted Word contents verbatim to stdout, which can leak sensitive contract data such as names, payment terms, liabilities, or other confidential clauses into logs, terminals, or agent transcripts. In an agent skill context, stdout is often captured and exposed beyond the immediate caller, increasing the chance of unintended disclosure.
Printing full extracted document text creates a direct sensitive-data exposure channel for user-provided contract contents. Because this skill is specifically designed to process contracts, the context makes the issue more dangerous: such files commonly contain confidential commercial, legal, and personal information that should not be echoed into output streams.
The file presents all user-facing instructions exclusively in Chinese, which can amount to a language policy constraint when no opt-in, alternative language option, or explicit region-specific justification is provided. The content appears targeted at Chinese contract review, but the quickstart does not clearly state that the skill is intentionally limited to Chinese-language users or documents.
The docstring at L201-L209 says this function generates a Markdown-format review report, including a three-column comparison table. However, the loop at L227-L230 appends each cell on its own line (| value\n) instead of emitting a single | a | b | c | row, so the produced output does not match the documented table structure.
The top-level module description presents the skill as a Chinese-language contract review/parser capability, and the user-facing strings throughout the file are exclusively in Chinese. Under the policy, forcing a specific language without user opt-in or documented justification is a natural-language policy concern.
No suspicious patterns detected.