ClawHub
Back to skill

Security audit

Legal case wdy

Security checks for vulnerabilities and agentic risk

Overview

This legal-search skill is coherent and disclosed, but it can send sensitive legal case details to a third-party API without a required confirmation or redaction step.

Review this skill before installing if you may describe real disputes. Use only minimal, anonymized legal search terms, avoid names, IDs, addresses, account details, medical details, or confidential facts, and confirm you are comfortable sending the query to the Wendaoyun third-party API under your own API key.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

other

Warning
Location
SKILL.md:20
Finding

Unredacted Legal Case Information Transmitted to a Third-Party API

Content
View full analysis
⚠️ **隐私风险提示**：本技能将用户描述的案件内容发送至第三方 API 进行检索，可能包含姓名、金额等个人隐私。请确认符合当地隐私法规，必要时建议用户自行判断是否适用。 ``` ### Technical Analysis The workflow directs the agent to use the user's case description, keywords, or summary as the `content` parameter of authenticated POST requests to `https://h5.wintaocloud.com`. Although the documentation discloses that information is sent to a third party, it does not require: - Explicit user consent immediately before transmission. - A preview of the exact content and destination. - Removal of names, addresses, identifiers, account details, or unrelated facts. - Data minimization to abstract legal search terms. - Verification of the provider's retention, processing, and logging practices. The trigger rules also permit direct retrieval when the user mentions legal keywords. Consequently, a detailed case narrative can be transmitted without a separate confirmation step. Disclosure alone does not adequately prevent unintended processing of sensitive legal or personal data. This is not evidence of covert exfiltration or malicious intent: the external request supports the advertised legal-retrieval function, and the privacy risk is disclosed. The vulnerability is the absence of enforceable consent and redaction controls before the transmission o ...[truncated 1679 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The trigger list includes broad, common phrases such as “纠纷”, “被骗”, “侵权”, and “打官司”, which can match ordinary conversation and cause the skill to activate unexpectedly. Because this skill transmits user-supplied case descriptions to a third-party legal API, unintended activation can lead to unnecessary disclosure of sensitive personal or dispute-related information.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill content and output format mandate Chinese-language interaction throughout without checking the user's language preference. This can cause the system to misunderstand user intent, provide unusable legal guidance, or prompt users to share sensitive case details in a language they did not choose, increasing the chance of accidental disclosure or unsafe reliance on misunderstood advice.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The skill explicitly instructs sending user case descriptions to an external third-party endpoint using an API key in the Authorization header. In the context of legal disputes, the transmitted content may contain highly sensitive personal, financial, and case-related facts, so external transmission creates a real privacy and data-governance risk even though the skill does disclose this behavior.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

调用示例：

bash
curl -s -X POST "https://h5.wintaocloud.com/prod-api/api/invoke/get-laws" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer ${WENDAOYUN_API_KEY}" \
  -d '{"content": "合同违约赔偿", "top_k": 3}'