Security audit
Security checks for vulnerabilities and agentic risk
The skill matches its legal-service purpose, but it can route sensitive legal facts and documents to external HaoLvShi services under broad implicit invocation and opens generated report links automatically.
Install only if you trust HaoLvShi with the legal facts, contracts, uploaded materials, and generated report links you provide. Prefer reviewing or pinning the installer source, verifying the zip/checksum when available, and avoid using it for highly sensitive matters unless you are comfortable with the external service's privacy and retention practices.
The Windows verification steps instruct users to run PowerShell with -ExecutionPolicy Bypass, which suppresses a key local safeguard and allows the script to run even when normal policy would block it. Combined with a network-enabled skill installer, this materially increases the chance of unreviewed script execution and abuse if the package or host is compromised.
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
curl -sI https://skills.ai.lvpin100.com/skills/haolvshi-legal-skill/INSTALL.md
curl -sI https://skills.ai.lvpin100.com/skills/haolvshi-legal-skill/haolvshi-legal-skill.zip
curl -sI https://skills.ai.lvpin100.com/skills/haolvshi-legal-skill/haolvshi-legal-skill-icon.png
The trigger condition is extremely broad: it says that any specific legal question, compensation calculation, social insurance estimate, contract review, or pleading generation should use this skill. Overbroad routing can capture common user requests unnecessarily, causing unintended transmission of sensitive personal or legal data to an external service and increasing the blast radius if the service or workflow is compromised.
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
state.rawNodes = response.nodes;
state.lastResponse = response.parsed;
state.stage = response.finished ? 'ready_for_report' : 'collecting';
delete state.pendingAnswerNodes;
delete state.followUpQueue;
delete state.followUpIndex;
await store.save(state);
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
state.rawNodes = response.nodes;
state.lastResponse = response.parsed;
state.stage = response.finished ? 'ready_for_report' : 'collecting';
delete state.pendingAnswerNodes;
delete state.followUpQueue;
delete state.followUpIndex;
await store.save(state);
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
state.rawNodes = response.nodes;
state.lastResponse = response.parsed;
state.stage = response.finished ? 'ready_for_report' : 'collecting';
delete state.pendingAnswerNodes;
delete state.followUpQueue;
delete state.followUpIndex;
await store.save(state);
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
state.rawNodes = response.nodes;
state.lastResponse = response.parsed;
state.stage = response.finished ? 'ready_for_report' : 'collecting';
delete state.pendingAnswerNodes;
delete state.followUpQueue;
delete state.followUpIndex;
await store.save(state);
The document states that the skill can execute shell/PowerShell, access the network, write temporary files, and auto-install a runtime, but it does not clearly warn users about the security implications. Users may grant broad execution privileges without understanding that untrusted installation content can run code and modify the local environment.
The install command uses npx skills without pinning an exact package/version, so installation behavior depends on whatever package is resolved at execution time. That creates a supply-chain risk: a compromised or unexpected upstream package version could execute arbitrary code during installation.
The document explicitly states 'Claude 不发布' and is written as operational guidance entirely in Chinese without offering any language or locale choice. Under the policy, forcing a specific language or locale without opt-in is a natural-language policy concern unless the locale restriction is documented and justified as region-specific, which is not established here.
文件从标题到全部使用说明均以中文呈现，并在多处以中文示例和中文交互要求为唯一表达方式，未见提供用户可选择语言/locale 的说明。按规则，若技能强制特定语言而没有用户选择或明确、合理的地区限定，属于自然语言政策问题。
The README describes sending legal case materials, contracts, and identity-related information to external online services, but it does not present a clear upfront data-transmission warning, consent notice, retention summary, or jurisdiction/privacy implications before users are encouraged to use the service. In a legal-services context, uploaded content can contain highly sensitive personal, financial, contractual, and dispute data, so insufficient disclosure raises material privacy and compliance risk.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
The skill explicitly requires shell/PowerShell execution and network access, but it does not declare an explicit tool scope such as permissions or allowed-tools. That creates a governance gap: a host may expose broader execution capability than intended, increasing the chance of arbitrary command execution or environment modification if the skill is invoked or misrouted.
The natural-language description states that the user can ask in one sentence and the skill will guide the workflow, but the file consistently presents the operational behavior only in Chinese and brands the skill as a Chinese legal workflow without any user-facing language choice. Because there is an English description field elsewhere, the absence of an explicit opt-in or language-selection instruction suggests the skill may force a specific language/locale experience.
The metadata describes very broad activation conditions for high-stakes legal workflows, including general legal questions, benefit calculations, contract review, and litigation document generation. Without clear trigger constraints, user requests may be routed into this skill too aggressively, causing unintended collection of sensitive personal data or unauthorized legal-style outputs in situations where the user did not explicitly opt into this workflow.
The display name, description, and default prompt are all specified only in Chinese, which implies a fixed language experience. The file does not indicate that users may choose another language or that the Chinese-only locale is a documented, justified regional restriction.
The manifest enables implicit invocation for a high-impact legal services skill without any visible trigger constraints, confirmation gates, or scope limitations. That can cause the agent to invoke the skill based on ambiguous user language and send sensitive legal facts, identity data, or dispute details to the external service when the user did not explicitly consent.
The eval includes the trigger phrase “帮我处理一下这个法律问题”, which is extremely broad and can cause the skill to activate for vague, underspecified requests. In a legal skill, over-triggering is risky because it may route users into authoritative-seeming legal workflows without first confirming the task type, increasing the chance of inappropriate automation or unintended data handling.
The skill explicitly instructs the host to automatically open an external report URL immediately after generating the legal calculation report. Automatically invoking browser or navigation capabilities on a remote URL without explicit user confirmation expands the skill's authority from producing content to triggering an external action, which can expose users to unwanted tracking, phishing, or unexpected navigation if the URL or upstream service is compromised.
The instruction to open the generated report link immediately provides no warning, consent step, or opportunity for the user to decline. In a legal-services context, report URLs may contain sensitive case details or session identifiers, so forced navigation can leak metadata to external services and create a poor security boundary between the chat agent and web content.
The entire skill is written as mandatory Chinese-language operating instructions and does not offer any language or locale choice for users. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified.
The skill instructs the agent to automatically open data.delivery.url immediately after emitting the report link, without requiring an explicit user confirmation step. This can trigger unintended navigation to an external or dynamically generated page, increasing the risk of phishing-like redirection, privacy leakage, or surprising side effects in the host environment.