Security audit

律师民事诉讼全流程自动化工作流

Security checks for vulnerabilities and agentic risk

Overview

This skill is not clearly malicious, but it should be reviewed carefully because it handles confidential litigation data, persists it locally, uses external research tools, and has under-disclosed licensing and accuracy risks.

Install only if you are comfortable placing confidential litigation materials in this tool's local workspace and using external research features. Review generated legal documents manually before filing, choose storage locations carefully, avoid unnecessary personal or privileged details in web/legal searches, and verify the party mappings and document specs for your filing posture.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill makes strong claims about deep legal reasoning, exhaustive legal research, adversarial analysis, and quality controls, but the file mostly contains orchestration instructions and shell calls without verifiable implementation of those safety-critical capabilities. In a legal workflow handling litigation documents and strategy, this can cause users to overtrust incomplete automation, leading to inaccurate filings, missed arguments, privacy exposure, or unauthorized external data transmission.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The skill embeds license checks, trial limits, payment prompts, and activation workflow into an agent that also processes sensitive legal matter data. Commercial enforcement logic is unrelated to the core legal task and creates unnecessary execution paths, possible device/user tracking, and opportunities to block or manipulate workflow behavior in ways users may not expect.

Context-Inappropriate Capability

Low

Confidence: 82% confidence
Finding: Prompting the agent to configure template paths under the user's home directory broadens filesystem access beyond the immediate case workspace. In a legal context, this increases the chance of accidental exposure, overwriting, or collection of unrelated sensitive files from the user's environment.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The document is titled '财产保全申请书', so the applicant should ordinarily be the party seeking relief and the respondent should be the adverse party. However, the spec maps 【申请人名称】 to case_data.parties.def.name and 【被申请人名称】 to case_data.parties.plt.name, which appears inverted relative to normal litigation semantics and the declared party_roles of ['被告']. In a legal-document automation workflow, this can generate filings that misidentify parties, causing incorrect submissions, procedural rejection, or strategically harmful filings against the wrong side.

Context-Inappropriate Capability

Medium

Confidence: 85% confidence
Finding: The module derives and stores a device fingerprint from host attributes for node-locked licensing, which exceeds the stated legal-workflow function and introduces unnecessary host-identifying data collection. While the fingerprint is limited and locally stored, it can still create privacy and portability concerns, especially because users are not clearly informed in the manifest that host identity is being bound to the license.

Vague Triggers

High

Confidence: 92% confidence
Finding: The trigger phrases are extremely broad and overlap with normal legal discussion terms such as '起诉', '答辩', and common civil dispute names. This raises the risk that the skill auto-activates during ordinary conversation and begins processing highly sensitive personal, evidentiary, or litigation-strategy data without sufficiently specific user intent.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The skill is designed to process identity documents, contact details, addresses, corporate identifiers, evidence files, and litigation materials, yet it does not prominently warn users about handling highly sensitive personal and case data. In a legal setting, inadequate disclosure materially increases privacy, confidentiality, and professional-responsibility risk.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The workflow describes network-based case-law and statute research through external services, but it does not clearly warn that case facts, party names, or dispute details may be sent to third parties. For litigation matters, silent external transmission can breach confidentiality obligations and expose privileged or regulated information.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The immutable trigger term "授权" is extremely broad in a legal-document workflow and can match many unrelated documents or user inputs containing ordinary authorization language. In this skill, broad activation or template selection can cause the wrong workflow/spec to be applied, leading to generation of an incorrect authorization document, data misbinding, or misuse of party/attorney fields in a sensitive legal context.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The guide instructs users to store case materials, evidence, and generated legal documents in a local workspace, but provides no warning about handling sensitive personal, financial, or litigation data. In a legal workflow, this omission is dangerous because users may place confidential client information into the system without understanding retention, access-control, backup, or disclosure risks.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The workflow promotes broad automated generation of pleadings and multi-channel case/law retrieval without warning that outputs may be inaccurate, incomplete, or based on external sources that expose confidential matter details. In litigation context, overreliance on unreviewed AI-generated documents or external retrieval can lead to court filing errors, disclosure of privileged facts, and significant legal or professional harm.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The workflow writes raw case data to disk under a predictable workspace path in the user's home directory without any consent prompt, minimization, encryption, or retention controls. In a legal-litigation skill, this data may contain highly sensitive personal, commercial, or privileged information, so unintended local disclosure becomes materially more serious than in a generic document workflow.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: The workflow creates directories and writes generated legal documents to disk automatically, without prior notice or consent. While file creation is core functionality, silent persistence of legal work product can expose sensitive documents to other local users, backups, sync tools, or endpoint indexing services.

Static analysis

Detected: suspicious.obfuscated_code

Potential obfuscated payload detected.

Warn

Code: suspicious.obfuscated_code
Location: scripts/license_manager.py:27