Security audit

Legal Doc Reviewer

Security checks for vulnerabilities and agentic risk

Overview

This legal-document review skill is mostly coherent, but it asks for broad command execution and includes an external callback option without enough controls for sensitive legal material.

Install only if you are comfortable with a legal-document assistant that may write local files, keep logs, and potentially use command execution. Do not use callback_url with privileged or confidential materials unless you fully control the endpoint and have approval to send the data there.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill declares a need for exec capability and advertises command execution, but the documented legal-review workflows are primarily text analysis, document parsing, and report generation. Adding shell execution broadens the attack surface significantly: prompt-influenced file operations or command invocation could be triggered on local systems without being necessary for the core task.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill says sensitive data should be desensitized before output, yet the examples preserve real-seeming names, roles, amounts, case identifiers, product names, and output paths. This inconsistency can cause users or downstream agents to treat sensitive legal matter details as safe to write into files, increasing the risk of confidentiality breaches in a context that often involves privileged or commercially sensitive information.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill instructs file writing and references command execution in the quick-start area, but it does not place a prominent warning near those instructions about local file modification and command-invocation risks. In agent environments, users may assume the skill is read-only or low-risk, leading to unintended filesystem changes or shell actions on sensitive workstations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The documented optional callback_url allows processed results to be sent to an external endpoint, but there is no privacy or data-transfer warning. Because the skill handles legal documents, reports, names, amounts, and potentially privileged material, an external callback can exfiltrate highly sensitive data to third parties or attacker-controlled servers.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.