Security audit

LegalFrance

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent French legal-search skill that downloads and builds local legal indexes after user confirmation, with no evidence of hidden exfiltration, privilege escalation, or unrelated behavior.

Install only if you are comfortable with a French-law-specific assistant that downloads a large legal corpus/model and stores local search indexes. Run the ingestion step deliberately, because rerunning it can rebuild the local Chroma legal index.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents an end-user French legal RAG assistant for answering legal questions and explaining legislation with verifiable citations. The supplied code chunk instead implements an internal benchmarking tool: it runs a fixed test suite, calls build_rag_prompt, checks whether expected article numbers were retrieved, computes retrieval metrics, and outputs a report. While this supports the broader legal RAG system, the primary purpose of this code is evaluation, not direct legal assistance. No suspicious extra permissions or unrelated resource access are present, but the behavior of this chunk is materially different from the declared assistant functionality.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill instructs execution of an ingestion step that writes substantial data to disk (data/chroma_db, data/fts_index.db) but does not declare any tool scope or permissions that would make this file-write capability explicit. Undeclared write behavior weakens least-privilege guarantees and can surprise users or hosting systems, especially because the step downloads external content and persists it locally.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest description and introductory text specify the skill as a French legal assistant ('Assistant juridique français', 'Assistant juridique FR') and all operational instructions are written only in French. This imposes a specific language/locale behavior without indicating that the user can choose another language or explicitly opt into French-only interaction.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The system prompt is entirely in French and instructs the assistant to behave as a French legal assistant, with no opt-in or language-selection mechanism. Under the policy, forcing a specific language or locale without user choice is a natural-language policy violation unless the constraint is explicitly justified and documented.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script unconditionally deletes the existing ChromaDB collection before recreating it, which causes irreversible loss of previously indexed data if the script is run accidentally or in the wrong environment. In an ingestion utility, this is a real safety issue because there is no confirmation, backup, or explicit reset flag gating the destructive operation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The function returns the fixed French string "Aucun résultat trouvé." for no-result cases, which imposes a specific language in user-visible output. The file also contains other French-only user-facing strings, but this line is a clear example of a locale choice being enforced without opt-in or justification.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.