Security audit

lawyer-assistant

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real PRC legal-assistant skill, but it is very broad and handles sensitive legal and identity data without enough privacy, retention, or scope controls.

Review before installing. Use it only for PRC legal-practice assistance, confirm the jurisdiction and matter type before relying on outputs, redact unnecessary IDs/contact/bank details, avoid sending confidential case materials through web searches, and manage any OCR or generated document files as sensitive legal records. All legal citations and strategy should still be checked by a qualified lawyer.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 77% confidence
Finding: The skill explicitly instructs use of a local OCR script and references output generation/templates, which implies file-writing or local file handling capability without any declared permission boundary. In a legal-assistant context, this is risky because uploaded evidence and OCR outputs may contain highly sensitive personal or case data, and undeclared write behavior reduces transparency and auditability.

Vague Triggers

High

Confidence: 89% confidence
Finding: The trigger scope is extremely broad, activating on effectively any legal-practice scenario without meaningful boundaries, jurisdiction checks, or escalation rules. In a legal context this increases the chance the skill is invoked for high-stakes matters such as criminal defense, enforcement, or labor disputes even when the facts are incomplete, the locale is wrong, or privileged/sensitive information is involved.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill directs users to upload evidence, run OCR on local files, and perform network retrieval, but it does not warn about confidentiality, personal data exposure, retention, or the risks of transmitting case materials to external services. For a legal-assistant workflow, this is especially dangerous because evidence often contains identity data, financial records, privileged communications, and litigation strategy.

Natural-Language Policy Violations

Medium

Confidence: 72% confidence
Finding: The skill is tightly coupled to Chinese legal sources and practice but does not prominently gate usage by jurisdiction or locale selection. If invoked by users with non-China matters or multilingual documents, it could produce legally inapplicable guidance that appears authoritative, which is particularly hazardous in legal decision-making.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The skill advertises a very broad "full-scenario lawyer assistant" scope and the trigger conditions cover nearly any legal-adjacent user request. This can cause over-activation, where the skill is invoked outside narrowly intended contexts and may steer sensitive legal workflows, document handling, or evidence analysis without sufficient boundaries or user intent confirmation.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The template explicitly collects highly sensitive identifiers and contact data, including 身份证号/统一社会信用代码 and 电话, but provides no minimization, masking, storage, retention, or access-control guidance. In a legal-assistance context, these fields are likely to be populated with real client and adversary data, increasing the risk of privacy violations, unauthorized disclosure, and downstream misuse if the template is copied, shared, or stored insecurely.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger list uses broad natural-language phrases that can match common user requests and auto-activate the skill without a narrowly scoped intent boundary. In a legal assistant, this can route ordinary conversation into a high-stakes domain workflow, causing unsolicited legal-style guidance, unnecessary web retrieval, or handling of sensitive facts when the user did not explicitly choose this skill.

Natural-Language Policy Violations

Low

Confidence: 80% confidence
Finding: The manifest hardcodes a China-specific legal domain and workflow assumptions without an explicit user-choice or jurisdiction confirmation step. This can mislead users from other jurisdictions or users asking comparative/general questions, resulting in incorrect legal framing and potentially harmful advice in a safety-critical professional context.

Static analysis

No suspicious patterns detected.