ClawHub
Back to skill

Security audit

Legal case wdy

Security checks for vulnerabilities and agentic risk

Overview

This legal-search skill is coherent and disclosed, but it can send sensitive legal case details to a third-party API without a required confirmation or redaction step.

Review this skill before installing if you may describe real disputes. Use only minimal, anonymized legal search terms, avoid names, IDs, addresses, account details, medical details, or confidential facts, and confirm you are comfortable sending the query to the Wendaoyun third-party API under your own API key.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

other

Warning
Location
SKILL.md:20
Finding
Unredacted Legal Case Information Transmitted to a Third-Party API<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 20–25; supporting privacy disclosure at line 42 **Vulnerability Type**: `other: Privacy Data Exposure` **Risk Level**: Medium The skill requires user-supplied legal case descriptions or summaries to be submitted to an external API. Legal narratives may contain names, addresses, financial information, injury details, accusations, case identifiers, and other sensitive personal information. The relevant mandatory workflow is: ```markdown **第 3 步：调用接口** - 根据需求调用对应接口： - 法律条文 → `get-laws` - 类似案例 → `get-cases` - 两者都要 → 两个都调用 - 入参 `content` 使用用户描述的案件关键词或摘要 ``` The documentation separately acknowledges the transmission: ```markdown > ⚠️ **隐私风险提示**：本技能将用户描述的案件内容发送至第三方 API 进行检索，可能包含姓名、金额等个人隐私。请确认符合当地隐私法规，必要时建议用户自行判断是否适用。 ``` ### Technical Analysis The workflow directs the agent to use the user's case description, keywords, or summary as the `content` parameter of authenticated POST requests to `https://h5.wintaocloud.com`. Although the documentation discloses that information is sent to a third party, it does not require: - Explicit user consent immediately before transmission. - A preview of the exact content and destination. - Removal of names, addresses, identifiers, account details, or unrelated facts. - Data minimization to abstract legal search terms. - Verification of the provider's retention, processing, and logging practices. The trigger rules also permit direct retrieval when the user mentions legal keywords. Consequently, a detailed case narrative can be transmitted without a separate confirmation step. Disclosure alone does not adequately prevent unintended processing of sensitive legal or personal data. This is not evidence of covert exfiltration or malicious intent: the external request supports the advertised legal-retrieval function, and the privacy risk is disclosed. The vulnerability is the absence of enforceable consent and redaction controls before the transmission o ...[truncated 1679 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Require explicit opt-in consent immediately before every external request involving user-provided case information. 2. Show the user the destination domain and the exact proposed request content before transmission. 3. Automatically remove or replace names, addresses, telephone numbers, identification numbers, account details, case identifiers, and other unique identifiers. 4. Convert narratives into minimal, abstract legal-search terms whenever possible, such as dispute type, relevant conduct, jurisdiction, and remedy sought. 5. Do not transmit information about third parties unless it is necessary and the user confirms that they are authorized to provide it. 6. Provide a local-only option in which the skill generates search keywords without contacting the external API. 7. Document the external provider's privacy policy, retention period, logging practices, processing location, and deletion procedure. 8. Ensure request and error logs do not record authorization headers or unredacted request bodies. 9. Add a mandatory preflight check that blocks transmission when sensitive identifiers remain in the request. 10. Permit users to cancel the operation or edit the redacted query before it is sent. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The trigger list includes broad, common phrases such as “纠纷”, “被骗”, “侵权”, and “打官司”, which can match ordinary conversation and cause the skill to activate unexpectedly. Because this skill transmits user-supplied case descriptions to a third-party legal API, unintended activation can lead to unnecessary disclosure of sensitive personal or dispute-related information.

Natural-Language Policy Violations

Medium
Confidence
88% confidence
Finding
The skill content and output format mandate Chinese-language interaction throughout without checking the user's language preference. This can cause the system to misunderstand user intent, provide unusable legal guidance, or prompt users to share sensitive case details in a language they did not choose, increasing the chance of accidental disclosure or unsafe reliance on misunderstood advice.

External Transmission

Medium
Category
Data Exfiltration
Content
**调用示例**：
```bash
curl -s -X POST "https://h5.wintaocloud.com/prod-api/api/invoke/get-laws" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer ${WENDAOYUN_API_KEY}" \
  -d '{"content": "合同违约赔偿", "top_k": 3}'
Confidence
95% confidence
Finding
The skill explicitly instructs sending user case descriptions to an external third-party endpoint using an API key in the Authorization header. In the context of legal disputes, the transmitted content may contain highly sensitive personal, financial, and case-related facts, so external transmission creates a real privacy and data-governance risk even though the skill does disclose this behavior.

Static analysis

No suspicious patterns detected.