Security audit

legal-assistant-pro

Security checks for vulnerabilities and agentic risk

Overview

This legal assistant is mostly coherent, but it adds automatic persistent learning and possible skill self-modification that is under-scoped for sensitive legal use.

Review before installing. The legal guidance features are understandable, but disable or remove the learner unless you explicitly want cross-session storage. Do not store legal facts, personal identifiers, dispute details, or private preferences in learned_patterns.json, and do not allow automatic SKILL.md updates without human review.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Warning

Location: scripts/learner.py:84
Finding: Unsanitized Persistent State Can Poison Future Agent Behavior
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill is ներկայացված as a legal assistant, but it also instructs use of a generic persistence and self-learning subsystem that records usage history, errors, and user preferences to local files. This hidden secondary behavior expands the trust boundary, creates privacy and data-retention risk, and can cause the agent to write/store information unrelated to the user’s expectation of legal guidance.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The listed trigger words include very broad phrases such as “法律咨询”, “维权”, and “劳动法”, which can appear in many ordinary user requests and do not clearly distinguish when this skill should activate versus when it should not. The file also does not provide exclusion conditions or negative examples to narrow invocation scope.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The documentation introduces an automatic learning and file-writing mechanism unrelated to the legal-assistant function. Even without executable code shown here, instructing the agent to maintain and update local state can lead to unauthorized persistence, scope creep, and collection of sensitive legal-interaction metadata.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill describes storing preferences and error notes without any clear privacy notice, consent mechanism, retention limit, or deletion path. In a legal-assistance context, even metadata about disputes, mistakes, or preferences can be sensitive and should not be silently retained.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly directs persistence of user preferences, usage counts, and error notes, which are not necessary to provide one-off legal guidance. In a legal context, these records may reveal sensitive behavioral or dispute-related information and create a silent cross-session memory channel.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The instructions establish a local memory file that persists usage-derived data across sessions, creating a durable state channel that can accumulate sensitive information over time. For a public legal skill, this is especially risky because legal matters commonly involve personal, financial, employment, family, or dispute-related details.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file implements a generic cross-skill telemetry and preference-learning module that is unrelated to the declared legal-assistant functionality. In a legal context, this increases risk because user interactions may contain sensitive legal matters, and collecting operational history across skills broadens data exposure beyond what users would reasonably expect.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This Python skill includes its primary docstring, CLI description, help text, and usage guidance entirely in Chinese, which imposes a specific language on users. The file does not provide any opt-in, alternative locale, or justification that the skill is intended only for a Chinese-speaking or region-specific environment.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The code writes learned_patterns.json containing recent operations, error notes, capabilities, and user preferences to disk without any access controls, encryption, retention policy, or manifest disclosure. For a legal-assistant skill, notes and preferences can easily include highly sensitive personal or dispute-related information, creating a meaningful privacy and confidentiality risk if the host is shared, compromised, or backed up insecurely.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The learning-system examples tell the operator to record capabilities such as '简历优化' and mention non-legal formatting/file issues, which conflicts with the surrounding documentation claiming this is a legal assistant. This indicates the embedded learning module documentation was copied from another domain and does not match the skill's stated intent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The example preference command sets 输出语言 to 中文, which signals a default language constraint in natural-language instructions without indicating that users may choose another language. Under the policy, forcing a specific language without user opt-in is a locale/language policy concern.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.