legal-assistant-pro

• Outcome: Review
• Latest audit: Aug 14, 2026 · 1:39 AM UTC
• Version: 1.0.0

Overview

The legal assistant content is mostly coherent, but it adds an automatic persistent learning system that can store sensitive legal-use details and encourages skill self-modification without clear user consent or retention controls.

Review before installing. The legal guidance features are ordinary, but the learning system should be disabled or rewritten unless you explicitly want local cross-session tracking. Do not use it with confidential legal facts unless storage, retention, deletion, and SKILL.md modification controls are added.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill is presented as a legal assistant, but it also documents persistent telemetry and self-learning behavior that records usage, failures, notes, and preferences for arbitrary skills. That hidden secondary behavior expands the trust boundary, creates unanticipated data collection, and enables file modification unrelated to legal assistance.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill instructs operators to run an external Python script that maintains persistent state and preferences, despite that capability not being necessary for core legal-reference assistance. This increases attack surface by introducing external code execution and durable storage behavior that users may not expect when invoking a legal help skill.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: A legal-reference skill should not silently accumulate experience and write operational learnings back into its own skill files. Self-modifying or self-updating instruction content can alter future behavior in uncontrolled ways, making review, provenance, and policy compliance much harder.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The module persistently stores user preferences, notes, and usage/error history in learned_patterns.json without any minimization, consent, retention limit, or sensitivity filtering. In a legal-assistant context, notes and preferences may contain highly sensitive personal or case information, so local persistence can create privacy leakage and secondary exposure risks if the host is shared, backed up, or later accessed by other components.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The skill describes storing user preferences, usage history, errors, and notes across sessions without a clear retention notice or meaningful consent flow. In a legal-assistance context, this is especially sensitive because user interactions may contain dispute details, employment issues, family matters, debt information, or other confidential legal facts.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: Persisting user preferences and usage history across sessions creates a natural-language data leakage risk, especially when notes and error descriptions may capture sensitive legal narratives. Cross-session memory can expose prior users' information, enable unintended profiling, or leak confidential matter context into future responses or logs.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.