ClawHub
Back to skill

Security audit

Legal case wdy

Security checks across malware telemetry and agentic risk

Overview

This legal-research skill is coherent and disclosed, but users should know it can send dispute details to a third-party API.

Install only if you are comfortable using WENDAOYUN's API for legal lookup. Before running searches, summarize facts minimally and remove names, IDs, phone numbers, addresses, and other private details where possible.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The skill metadata advertises very broad trigger phrases such as '纠纷', '被骗', and '打官司', which can match ordinary conversation and cause the legal-retrieval workflow to activate without clear user intent. Because the skill sends user-described case facts to a third-party API, unintended activation can expose sensitive personal or dispute information and produce unsolicited legal-style guidance.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The activation logic says that if a user merely describes a dispute and does not mention retrieval, the skill should proactively ask whether to search laws and similar cases, which is an ambiguous activation boundary for a privacy-sensitive legal tool. In context, the skill is designed to forward case descriptions that may include names, money amounts, and other personal details to a third-party service, so broad conversational matching increases the risk of unintentional data disclosure and inappropriate legal assistance flow.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.