Klaus Processos Br

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:18 AM UTC
• Version: 0.0.1

Overview

The skill appears purpose-built for Brazilian court lookups, but it has review-worthy credential handling and local retention issues.

Review before installing. Do not run dry-run with a private DATAJUD_API_KEY unless the Authorization header is redacted, and treat monitored case numbers as locally stored sensitive data. Prefer a version that removes the embedded key, masks headers, and clearly documents or lets you configure the monitoring state file.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: src/cli.py:168

Finding

Hard-Coded API Credential and Authorization Header Disclosure

Content

View full analysis

Vulnerability Details

File Location: src/datajud_client.py:15-27, src/cli.py:168-174, README.md:133-136, and SKILL.md:108-110
Vulnerability Type: Hard-coded credential and sensitive header exposure
Risk Level: Medium

Evidence

src/datajud_client.py:15-27:

python

BASE_URL = "https://api-publica.datajud.cnj.jus.br"
DEFAULT_API_KEY = "cDZHYzlZa0JadVREZDJCendQbXY6SkJlTzNjLV9TRENyQk1RdnFKZGRQdw=="

class DataJudClient:
    def __init__(self, api_key: Optional[str] = None):
        self.api_key = api_key or os.environ.get("DATAJUD_API_KEY", DEFAULT_API_KEY)
        self.last_request_time = 0
        self.min_interval = 0.5  # 2 req/s max
    
    def _headers(self) -> dict:
        return {
            "Authorization": f"APIKey {self.api_key}",
            "Content-Type": "application/json"
        }

src/cli.py:168-174:

python

url = f"https://api-publica.datajud.cnj.jus.br/api_publica_{tribunal}/_search"
query = {"query": {"match": {"numeroProcesso": numero}}, "size": 10}

print("=== DRY RUN ===")
print(f"URL: {url}")
print(f"Headers: {client._headers()}")
print(f"Payload: {query}")
sys.exit(0)

README.md:133-136:

markdown

The public API key is embedded by default. Optionally, set via environment variable:

```bash
export DATAJUD_API_KEY="cDZHYzlZa0JadVREZDJCendQbXY6SkJlTzNjLV9TRENyQk1RvnFKZGRQdw=="

text

`SKILL.md:108-110`:

```markdown
A API Key pública do DataJud já está configurada por padrão. Opcionalmente, pode-se definir via variável de ambiente:

DATAJUD_API_KEY=cDZHYzlZa0JadVREZDJCendQbXY6SkJlTzNjLV9TRENyQk1RvnFKZGRQdw==

text

Technical Analysis

The DataJud API credential is embedded directly in the source code and duplicated in project documentation. Any user with access to the repository can extract and reuse it. Although the documentation describes this as a public API key, embedding credentials ...[truncated 2020 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove DEFAULT_API_KEY from the source and require DATAJUD_API_KEY to be supplied through the runtime environment or an approved secret manager.

2. Fail safely with a clear configuration error when no credential is available.

3. Never print the complete authorization header. Redact it in dry-run output, for example:

   python

   safe_headers = client._headers().copy()
   if "Authorization" in safe_headers:
       safe_headers["Authorization"] = "APIKey ****"
   print(f"Headers: {safe_headers}")
   

4. Replace credentials in README.md and SKILL.md with placeholders such as:

   bash

   export DATAJUD_API_KEY="YOUR_DATAJUD_API_KEY"
   

5. Rotate the exposed credential if it is not deliberately public, and review service logs for unexpected use.

6. Keep one authoritative configuration method to prevent mismatches between source code and documentation.

7. Add automated secret scanning and a test asserting that dry-run output never contains the configured credential.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared purpose says the skill consults judicial cases via a public API, but the documented behavior also includes persistent monitoring, local state storage, update detection, and list management. This mismatch is security-relevant because users or orchestration systems may authorize a simple lookup skill while unknowingly enabling ongoing retention and processing of sensitive legal identifiers and case activity.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The README presents the skill as exclusive to Brazilian court processes and uses Portuguese-facing wording, which imposes a specific locale scope. Under the stated policy, locale constraints should either offer user opt-in/choice or be clearly documented as justified; this exclusivity is asserted but not explicitly justified as a regional limitation in policy terms.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The README reveals that a public API key is embedded by default and even prints the token value directly in configuration instructions. Publishing a usable credential in documentation encourages uncontrolled reuse, makes rotation difficult, and can lead to quota exhaustion or service abuse attributed to the skill author or users.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

A skill that can access environment variables, local files, write state, and make network requests should explicitly declare its tool scope. Without an allowlist or permissions block, consumers and enforcement layers may not understand that the skill can persist judicial case data locally and interact with external services, which increases the risk of overbroad access and unintended data exposure.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest states the skill is for consulting Brazilian judicial processes via the public DataJud API. In addition to consultation and search, this file exposes monitor-add, monitor-remove, monitor-check, and monitor-list commands, indicating ongoing tracking/stateful monitoring functionality beyond simple consultation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Printing request headers directly is a concrete secret-exposure issue because API credentials are commonly carried in headers. In the context of a CLI for public API access, users may reasonably run dry-run for debugging, making accidental credential leakage to shell logs and shared output more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The client falls back to a hardcoded default API key when no environment variable is set, embedding a credential directly in source code. Hardcoded credentials are dangerous because they are easy to leak, difficult to rotate, may be reused outside intended contexts, and can enable unauthorized use or quota abuse if the repository or package is exposed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The client sends request bodies containing user-provided case numbers and party-name search terms to an external CNJ API, but this file does not include any user-facing notice, confirmation, logging, or comment warning that such data is transmitted over the network. Because these queries can contain sensitive judicial lookup information, the absence of disclosure is a safety-relevant omission for a code file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This Python file contains multiple natural-language strings and docstrings exclusively in Portuguese, such as headings and status messages shown to users. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This code contains natural-language documentation and return messages exclusively in Portuguese, which can impose a specific language on users or maintainers without opt-in. The policy explicitly calls for flagging language or locale constraints when no choice or justification is provided.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The README documents monitoring functionality and a local state file, but does not warn users that judicial case identifiers will be persisted on disk. Even if the data is limited to public case numbers, storing litigation-related identifiers locally can expose sensitive user interests or monitored matters to other local users, backups, or endpoint telemetry.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The monitoring section describes adding, listing, checking, and removing tracked processes, but it does not warn users that case numbers and related update metadata are retained locally. Even though the source is a public judicial API, persistent storage of legal case identifiers can create privacy, compliance, and operational risks if users are unaware of retention behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file presents its interface entirely in Portuguese, including the module docstring and command help text, without offering any language selection or documenting a locale-specific constraint. This can violate language/locale policy when a skill forces a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The --dry-run mode promises to only print the query, but it also prints the full request headers via client._headers(). If those headers contain Authorization tokens or API keys, they may be exposed in terminal history, logs, screenshots, or CI output, creating a credential disclosure risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file’s natural-language documentation is written entirely in Portuguese, and the same language choice continues in docstrings and comments throughout the module. Under the policy provided, forcing a specific language without user choice or a documented locale-specific justification is a natural-language policy issue.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.