ClawHub
Back to skill

Security audit

好律狮法律技能包

Security checks for vulnerabilities and agentic risk

Overview

The skill largely matches its legal-assistant purpose, but it handles sensitive legal materials through external APIs and local task files with a cleanup claim that is not fully backed by the code.

Review this before installing because legal questions, contracts, identity details, and case materials may be sent to HaoLvShi services and stored locally in the skill state directory. Run the cleanup command after sensitive matters, consider setting HAOLVSHI_STATE_DIR to a protected location, and avoid the npx install path if you require pinned tooling or manual zip review.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (86)

Missing User Warnings

High
Confidence
97% confidence
Finding
`ExecutionPolicy Bypass` 会降低 PowerShell 执行限制，属于可能影响系统完整性的高风险操作。文档直接给出该命令用于运行本地脚本，但未提醒用户这一参数的含义、适用场景或应仅在信任脚本来源时使用。

External Script Fetching

High
Category
Supply Chain
Content
### 发布后检查

```bash
curl -sI https://skills.ai.lvpin100.com/skills/haolvshi-legal-skill/INSTALL.md
curl -sI https://skills.ai.lvpin100.com/skills/haolvshi-legal-skill/haolvshi-legal-skill.zip
curl -sI https://skills.ai.lvpin100.com/skills/haolvshi-legal-skill/haolvshi-legal-skill-icon.png
Confidence
90% confidence
Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
The declared description presents an end-user legal assistant skill focused on legal analysis, pension/social insurance calculations, contract review, and legal document generation through professional legal APIs. The actual code shown does none of that. Its primary purpose is operational bootstrapping: detecting a suitable Node.js binary, downloading and verifying Node.js if absent, persisting the runtime path, chmod'ing entrypoint files, and preparing a state directory. These are infrastructure/setup behaviors, not the legal-service behaviors described. While setup code can be a supporting implementation detail, this chunk’s behavior is entirely about runtime installation and environment preparation, with no visible legal logic or API invocation. Therefore, for this supplied code chunk, the description does not accurately represent what the code actually does.

Ae1

High
Category
analysis-evasion
Content
2. 运行环境准备只需首次执行，它会补齐脚本执行位并建好状态目录；之后只用 `run.sh` 或 `run.ps1` 调用命令。
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
2. 运行环境准备只需首次执行，它会补齐脚本执行位并建好状态目录；之后只用 `run.sh` 或 `run.ps1` 调用命令。
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
2. 运行环境准备只需首次执行，它会补齐脚本执行位并建好状态目录；之后只用 `run.sh` 或 `run.ps1` 调用命令。
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
2. 运行环境准备只需首次执行，它会补齐脚本执行位并建好状态目录；之后只用 `run.sh` 或 `run.ps1` 调用命令。
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
2. 运行环境准备只需首次执行，它会补齐脚本执行位并建好状态目录；之后只用 `run.sh` 或 `run.ps1` 调用命令。
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
2. 运行环境准备只需首次执行，它会补齐脚本执行位并建好状态目录；之后只用 `run.sh` 或 `run.ps1` 调用命令。
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
2. 运行环境准备只需首次执行，它会补齐脚本执行位并建好状态目录；之后只用 `run.sh` 或 `run.ps1` 调用命令。
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
| 上传或无法读取材料 | `references/case-materials.md` |
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
| 材料、控件之外的能力异常 | 对应能力参考或 `references/errors.md` |
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
| 材料、控件之外的能力异常 | 对应能力参考或 `references/errors.md` |
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
sh scripts/bootstrap.sh --ensure
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
powershell -ExecutionPolicy Bypass -File scripts/bootstrap.ps1 -Ensure
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
后调用 `question-start`；`stage=ready_for_report` 时调用 `question-report`。目录和问答异常才读 `references/consultation.md`。
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
后调用 `question-start`；`stage=ready_for_report` 时调用 `question-report`。目录和问答异常才读 `references/calculator.md`。
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
先确认用户代表甲方或乙方，未知时直接呈现脚本返回的原生单选。确认立场和合同文件后调用 `contract-review`。仅在连接中断且脚本给出本任务 `sessionId` 时调用一次 `resume`，不轮询。异常才读 `references/contract-review.md`。
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
ading-update`，只问没有唯一依据的字段。确认摘要后以 `confirmed: true` 调用 `pleading-generate`。异常才读 `references/pleading.md`。
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Memory Manipulation

High
Category
Memory Poisoning
Content
state.rawNodes = response.nodes;
  state.lastResponse = response.parsed;
  state.stage = response.finished ? 'ready_for_report' : 'collecting';
  delete state.pendingAnswerNodes;
  delete state.followUpQueue;
  delete state.followUpIndex;
  await store.save(state);
Confidence
80% confidence
Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Memory Manipulation

High
Category
Memory Poisoning
Content
state.rawNodes = response.nodes;
  state.lastResponse = response.parsed;
  state.stage = response.finished ? 'ready_for_report' : 'collecting';
  delete state.pendingAnswerNodes;
  delete state.followUpQueue;
  delete state.followUpIndex;
  await store.save(state);
Confidence
80% confidence
Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Memory Manipulation

High
Category
Memory Poisoning
Content
state.rawNodes = response.nodes;
  state.lastResponse = response.parsed;
  state.stage = response.finished ? 'ready_for_report' : 'collecting';
  delete state.pendingAnswerNodes;
  delete state.followUpQueue;
  delete state.followUpIndex;
  await store.save(state);
Confidence
80% confidence
Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Memory Manipulation

High
Category
Memory Poisoning
Content
state.rawNodes = response.nodes;
  state.lastResponse = response.parsed;
  state.stage = response.finished ? 'ready_for_report' : 'collecting';
  delete state.pendingAnswerNodes;
  delete state.followUpQueue;
  delete state.followUpIndex;
  await store.save(state);
Confidence
80% confidence
Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
该 Markdown 文件说明技能需要执行 shell/PowerShell、访问网络、读写临时文件，并且首次运行时会自动检查并安装运行环境。这些行为会影响系统环境与网络通信，但文档仅描述功能前提，没有显式提醒用户相关影响、确认需求或潜在风险。

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
tests/environment.test.mjs:14