ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Legal Docs Pro

v1.0.3

Your landlord just sent a 12-page lease renewal and you have no idea what half the clauses mean. Or you need an NDA for a freelancer by tomorrow and LegalZoo...

⭐ 0· 76·0 current·0 all-time
by@nollio
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
The name/description (legal document generation, review, explanations) matches the files and instructions. Required resources are local files and optional helper binaries (pandoc, pdftotext) referenced by scripts — these are reasonable for PDF/text extraction and export. No unrelated credentials, network endpoints, or external cloud APIs are requested in the package metadata.
ℹ
Instruction Scope
SKILL.md explicitly instructs the agent to read and update config/settings.json (business profile) for every session, auto-populate documents from that profile, and save generated documents/reviews to local data directories and dashboard tables. This is consistent with the purpose, but it implies automatic local persistence of sensitive fields (EIN, contact info) and automatic saving of reviewed/uploaded contract text unless the user opts out or the agent is told not to save.
✓
Install Mechanism
No remote download/install is required — this is an instruction-and-script bundle. The included shell scripts rely on standard third-party CLI tools (pdftotext/poppler, pandoc, textutil, python3) for extraction/export. That is moderate dependency usage but not unexpected; there are no obscure URLs, extract steps, or remote installers in the provided files.
ℹ
Credentials
No environment variables or external credentials are requested (proportional). However, the skill stores PII/PII-adjacent data (EIN, addresses, emails, contract text) in plaintext under its config/data directories by design. The SKILL.md and SECURITY.md acknowledge that AI provider processing of conversation content may send data to the model provider — users should be aware conversation contents (including pasted contracts) may leave their machine depending on the underlying AI provider.
✓
Persistence & Privilege
always:false and no requests to alter other skills or system-wide settings. The skill writes its own data (data/documents, data/reviews, ld_* dashboard tables) and uses its own config directory. This level of local persistence is expected for a document management tool and is within the skill's stated scope.
Assessment
What to consider before installing: - Data storage: The skill stores your business profile (including EIN, addresses, emails) in plaintext under the skill's config/data directories and will auto-save generated documents and contract-review copies to local folders (data/documents, data/reviews) and the local dashboard tables. If you don’t want that behavior, inspect or edit SKILL.md and scripts to disable autosave or remove sensitive fields before using. - Model data exposure: Contract text you paste into the agent is processed by the underlying AI provider. Review your AI provider's privacy/data-handling policies before sending highly confidential material (M&A, litigation, proprietary trade secrets). The skill’s SECURITY.md correctly calls this out. - Scripts to review: The package includes shell scripts (setup.sh, export-doc.sh, contract-scan.sh). contract-scan.sh is benign and only extracts text and optionally saves a local copy; export-doc.sh and setup.sh contents should be reviewed before execution to ensure they don't perform unexpected network operations. Do not run scripts you haven't inspected. - Required tools: PDF/.docx extraction and PDF export rely on external tools (poppler/pdftotext, pandoc, textutil). Install these from trusted package managers if needed; the scripts fail safely if absent. - File permissions & isolation: After setup, restrict access to the skill data directory (chmod 700 config/ or the whole skill directory) and consider running the skill on a machine you control. If you want extra safety, run first use in an isolated environment (VM) and verify file writes. - When in doubt: Do not paste highly sensitive contracts or tax IDs until you’ve inspected setup.sh and export-doc.sh for network calls, and confirm you are comfortable with local storage behavior. If you need absolute confidentiality, consult a licensed attorney rather than relying solely on AI-generated reviews.

Like a lobster shell, security has layers — review code before you run it.

latestvk97brn3aba4svfq9yhm53dazhs83ysy0

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments