Security audit

Legal Docs Pro

Security checks for vulnerabilities and agentic risk

Overview

This legal-document skill matches its stated purpose, but its scripts can expose sensitive local files or run unintended code from crafted input, so it needs review before installation.

Do not install this version without review or patching. Avoid entering EIN or other sensitive identifiers unless required, do not scan untrusted files or arbitrary paths, and treat generated profiles, contracts, reviews, and dashboard records as local sensitive files that may also enter your AI provider's conversation context.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/setup.sh:82
Finding: Python Code Injection Through Business Profile Fields
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/contract-scan.sh:77
Finding: Python Code Injection Through a Crafted PDF Filename
Content: View full analysis
/dev/null; then CONTENT=$(pdftotext "$INPUT_FILE" - 2>/dev/null) elif command -v python3 &>/dev/null; then CONTENT=$(python3 -c " import subprocess, sys try: result = subprocess.run(['textutil', '-convert', 'txt', '-stdout', '$INPUT_FILE'], capture_output=True, text=True) print(result.stdout) except Exception: print('Error: Cannot extract text from PDF. Install poppler: brew install poppler', file=sys.stderr) sys.exit(1) " 2>/dev/null) || { echo "Error: Cannot extract text from PDF." >&2 echo "Install poppler: brew install poppler (macOS) or sudo apt install poppler-utils (Linux)" >&2 exit 1 } ``` ### Technical Analysis The user-controlled `INPUT_FILE` value is inserted directly into a single-quoted Python string inside dynamically generated Python source. Shell quoting around the outer command does not protect the value when Python parses the resulting program. A filename containing Python quote and statement delimiters can terminate the intended filename literal and inject additional Python statements. The vulnerable fallback is reached when: - The selected file has a `.pdf` extension. - `pdftotext` is unavailable. - `python3` is available. The use of a list with `subprocess.run` would ordinarily avoid shell argument injection, but that protection is defeated because the list itself is constructed from attacker-influenced Python source. ### Attack Path 1. An attacker creates or provides a PDF whose filename contains Python syntax designed to terminate the filename literal. 2. The user or agent invokes `contract-scan.sh` on that file. 3. The host does not have `pdftotext`, causing executi ...[truncated 847 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/contract-scan.sh:51
Finding: Arbitrary Local-File Disclosure Through Contract Scanning
Content: View full analysis
&2 echo "" usage exit 1 fi if [[ ! -f "$INPUT_FILE" ]]; then echo "Error: file not found: $INPUT_FILE" >&2 exit 1 fi ``` ```bash *) echo "Warning: Unrecognized file type '.$FILE_EXT'. Attempting to read as plain text." >&2 CONTENT=$(cat "$INPUT_FILE") ;; ``` ```bash # Output for agent review echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━" echo "📋 CONTRACT SCAN: $FILE_NAME" echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━" echo "Source: $INPUT_FILE" echo "Size: $FILE_SIZE bytes | $WORD_COUNT words | $LINE_COUNT lines" echo "Format: .$FILE_EXT" echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━" echo "" echo "Please review the following contract using the Legal Docs Pro" echo "multi-pass review process (identify → flag risks → check missing" echo "protections → summarize):" echo "" echo "--- BEGIN CONTRACT TEXT ---" echo "" echo "$CONTENT" echo "" echo "--- END CONTRACT TEXT ---" ``` ### Technical Analysis The scanner accepts any path that resolves to a readable regular file. It does not: - Restrict files to a designated contract-import directory. - Enforce a strict supported-extension allowlist. - Validate MIME type. - Reject symlinks. - Require confirmation for paths outside an approved root. For an unrecognized extension, the script explicitly reads the file as plaintext and prints its entire contents. Since the output is intended for agent review, those contents can enter the model’s context and become subject to the underlying AI provider’s processing and retention policies. The script’s use of quoted shell variables prevents ordinary shell metacharacter injection in `c ...[truncated 1302 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/export-doc.sh:101
Finding: Path Traversal Permits Export of Files Outside the Document Directory
Content: View full analysis
&2 echo "Use --list to see available documents, or specify a filename." >&2 echo "" usage exit 1 fi SOURCE="$DOCS_DIR/$FILENAME" # Check source exists if [[ ! -f "$SOURCE" ]]; then echo "Error: document not found: $FILENAME" >&2 echo "Use --list to see available documents." >&2 exit 1 fi # Determine output path if [[ -z "$OUTPUT" ]]; then BASENAME="${FILENAME%.md}" OUTPUT="$HOME/Documents/${BASENAME}.${FORMAT}" fi # Ensure output directory exists OUTPUT_DIR=$(dirname "$OUTPUT") mkdir -p "$OUTPUT_DIR" if [[ "$FORMAT" == "md" ]]; then cp "$SOURCE" "$OUTPUT" echo "✓ Exported to: $OUTPUT" ``` ### Technical Analysis The script assumes that `FILENAME` names a file under `data/documents`, but it concatenates the value directly with `DOCS_DIR` and performs no canonical-path containment check. Directory traversal sequences can therefore escape the intended directory. The `-f` check only confirms that the resolved target exists and is a regular file. It does not confirm that the target remains within `data/documents`. The Markdown export path then copies the escaped source to an arbitrary user-selected output location. The PDF branch can also pass an escaped source to Pandoc and an installed PDF engine. The most direct impact, however, is arbitrary readable-file copying through the Markdown branch. ### Attack Path 1. An attacker supplies a filename containing parent-directory traversal components. 2. The combined `SOURCE` path resolves outside `data/documents`. 3. The existence check succeeds for a readable target such as the local settings file. 4. The attacker selects Markdown output and an output path accessi ...[truncated 858 chars]
Remediation: View remediation

T01 · Skill Instruction Hijacking

Warning

Location: scripts/contract-scan.sh:145
Finding: Untrusted Contract Content Is Exposed to the Agent Without a Prompt-Injection Boundary
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (31)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The README states that the skill remembers business details including name, address, EIN, and standard terms, but it does not pair this with any clear warning about local storage, access controls, retention, or sensitivity of that data. In a legal-document context, storing business identifiers and profile data without explicit handling guidance can lead to unintentional exposure through shared workstations, backups, logs, or insecure configuration files.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The setup guide instructs users to enter and persist sensitive business information, including EIN, address, owner identity, and contact details, into a local settings file without any warning about local storage, access controls, backup exposure, or sharing risks. In a skill context, this increases the chance that users unknowingly place regulated or sensitive data into a workspace that may be readable by other tools, copied into exports, or exposed through support/debug workflows.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SETUP-PROMPT.md (reported line 77)May include surrounding context.
brew install pandoc

Linux (Debian/Ubuntu)

sudo apt install pandoc

text
Markdown export works out of the box — no extra tools needed.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · README.md (reported line 35)May include surrounding context.
The user must run setup.sh before first use. This creates the data directory and business profile:

bash
chmod 700 scripts/setup.sh && bash scripts/setup.sh

Business profile is stored in config/settings.json. The agent reads this file at the start of every document generation or review session.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SETUP-PROMPT.md (reported line 27)May include surrounding context.
The user must run setup.sh before first use. This creates the data directory and business profile:

bash
chmod 700 scripts/setup.sh && bash scripts/setup.sh

Business profile is stored in config/settings.json. The agent reads this file at the start of every document generation or review session.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.
The user must run setup.sh before first use. This creates the data directory and business profile:

bash
chmod 700 scripts/setup.sh && bash scripts/setup.sh

Business profile is stored in config/settings.json. The agent reads this file at the start of every document generation or review session.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs storing a detailed business profile in config/settings.json, including highly sensitive fields like EIN, address, owner contact details, and contract defaults, and reusing it automatically across tasks. Without explicit consent, minimization, access control, retention guidance, or warnings about local plaintext storage, this creates a real privacy and data-exposure risk if the host, workspace, backups, or logs are accessed by others.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill says that when the user provides new business details in conversation, the agent should update config/settings.json and confirm changes, but it does not require explicit consent to persist those details. This creates a meaningful risk of silently retaining sensitive business or personal information that the user may have intended only for the current conversation.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The instructions create a data retention mechanism where missing fields are collected once, saved, and reused indefinitely going forward. That persistence expands the blast radius of any accidental disclosure, compromise, or misuse because sensitive information accumulates over time beyond the immediate task need.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.
md
### Auto-Population Every generated document MUST pull from the business profile. Never ask the user to re-enter information that exists in their profile. If a field is needed but missing, ask once, save it to the profile, and use it going forward. ---

Behavior Manipulation

Medium

Category: Prompt Injection
Confidence: 75% confidence
Finding: Subtle instructions detected that may alter agent decision-making or introduce hidden biases.
Content: Scanner excerpt · SKILL.md (reported line 232)May include surrounding context.
md
### Review Rules - Always note: "Consult an attorney for complex or high-value agreements" - Never tell the user a contract is "safe" in absolute terms — use "appears standard" or "no unusual provisions identified" - If the contract involves real estate, employment disputes, or amounts over $25,000, strongly recommend attorney review regardless of risk score - Flag any clause that creates personal liability for a business owner (piercing the corporate veil risk) - Flag any automatic renewal or evergreen clauses

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The spec directs the agent to persist legal documents, contract reviews, file paths, parties, values, and renewal data locally and expose them through dashboard views, but it does not mention any user consent, access controls, retention limits, redaction, or warning that sensitive legal data will be stored and displayed. In the context of legal workflows, this creates a meaningful confidentiality and privacy risk because highly sensitive contract content and metadata may be retained or surfaced to unintended local users or dashboard viewers.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts/contract-scan.sh (reported line 96)May include surrounding context.
sh
sys.exit(1) " 2>/dev/null) || { echo "Error: Cannot extract text from PDF." >&2 echo "Install poppler: brew install poppler (macOS) or sudo apt install poppler-utils (Linux)" >&2 exit 1 } else

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts/export-doc.sh (reported line 141)May include surrounding context.
sh
sys.exit(1) " 2>/dev/null) || { echo "Error: Cannot extract text from PDF." >&2 echo "Install poppler: brew install poppler (macOS) or sudo apt install poppler-utils (Linux)" >&2 exit 1 } else

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts/export-doc.sh (reported line 164)May include surrounding context.
sh
sys.exit(1) " 2>/dev/null) || { echo "Error: Cannot extract text from PDF." >&2 echo "Install poppler: brew install poppler (macOS) or sudo apt install poppler-utils (Linux)" >&2 exit 1 } else

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: When --save is used, the script writes a copy of the full contract into a local reviews directory without any sensitivity warning, access control checks, or retention safeguards. This increases the risk of inadvertent data persistence, backup propagation, and unauthorized access by other local users or tools that scan the workspace.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script prints the full contract contents to stdout for downstream agent review, which can expose sensitive legal, financial, or personal data in terminal history, logs, agent transcripts, or other telemetry. In an agent skill context this is more dangerous because stdout is often captured automatically and may be sent to remote systems or retained longer than the user expects.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SECURITY.md (reported line 29)May include surrounding context.
md
mkdir -p "$DATA_DIR/exports" # Set permissions on sensitive directories chmod 700 "$CONFIG_DIR" chmod 700 "$DATA_DIR" echo "✓ Data directories created"

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SECURITY.md (reported line 35)May include surrounding context.
md
mkdir -p "$DATA_DIR/exports" # Set permissions on sensitive directories chmod 700 "$CONFIG_DIR" chmod 700 "$DATA_DIR" echo "✓ Data directories created"

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts/setup.sh (reported line 24)May include surrounding context.
sh
mkdir -p "$DATA_DIR/exports" # Set permissions on sensitive directories chmod 700 "$CONFIG_DIR" chmod 700 "$DATA_DIR" echo "✓ Data directories created"

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts/setup.sh (reported line 25)May include surrounding context.
sh
mkdir -p "$DATA_DIR/exports" # Set permissions on sensitive directories chmod 700 "$CONFIG_DIR" chmod 700 "$DATA_DIR" echo "✓ Data directories created"

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script interactively collects sensitive business and personal data, including address, EIN, signatory name, email, and phone number, and writes it to a persistent JSON file on disk without clearly warning the user beforehand that this information will be stored locally. In a setup flow for a legal-document skill, that increases privacy risk because users may disclose regulated or sensitive business information under the assumption it is only used transiently.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts/setup.sh (reported line 109)May include surrounding context.
sh
json.dump(settings, f, indent=2) " chmod 600 "$SETTINGS_FILE" echo "" echo "━━━━━━━━━━━━━━━━━━━━━━━━━"

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The example invocation "Review this contract" is very broad and does not define scope, constraints, or exclusion conditions. In a skill README, this can make activation boundaries unclear because it resembles a generic everyday request rather than a narrowly scoped trigger.
Content: No source excerpt is available for this finding.

Excessive Permissions

Low

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.
Content: Scanner excerpt · SECURITY.md (reported line 35)May include surrounding context.
md
## Recommendations 1. **File permissions:** Run `chmod 700 config/` to restrict access to your business profile 2. **Backup:** Keep copies of important generated documents outside the skill directory 3. **Sensitive contracts:** For highly confidential agreements (M&A, litigation-related), consider whether AI-assisted review is appropriate for your situation 4. **Regular review:** Periodically review `config/settings.json` to ensure it contains only information you intend to store

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T05 · Unauthorized Access and Privilege Escalation

T05 · Unauthorized Access and Privilege Escalation

T01 · Skill Instruction Hijacking

SkillSpector

Missing User Warnings

Missing User Warnings

Sudo/Root Execution

Linux (Debian/Ubuntu)

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Missing User Warnings

Missing User Warnings

Ssd 3

Autonomous Decision Making

Behavior Manipulation

Missing User Warnings

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Missing User Warnings

Missing User Warnings

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Missing User Warnings

Sudo/Root Execution

Vague Triggers

Excessive Permissions

Static analysis