ClawHub
Back to skill

Security audit

Legal Doc Reviewer

Security checks across malware telemetry and agentic risk

Overview

This legal-document review skill is mostly coherent, but it asks for broad command execution and includes an external callback option without enough controls for sensitive legal material.

Install only if you are comfortable with a legal-document assistant that may write local files, keep logs, and potentially use command execution. Do not use callback_url with privileged or confidential materials unless you fully control the endpoint and have approval to send the data there.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The skill declares a need for exec capability and advertises command execution, but the documented legal-review workflows are primarily text analysis, document parsing, and report generation. Adding shell execution broadens the attack surface significantly: prompt-influenced file operations or command invocation could be triggered on local systems without being necessary for the core task.

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The skill says sensitive data should be desensitized before output, yet the examples preserve real-seeming names, roles, amounts, case identifiers, product names, and output paths. This inconsistency can cause users or downstream agents to treat sensitive legal matter details as safe to write into files, increasing the risk of confidentiality breaches in a context that often involves privileged or commercially sensitive information.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill instructs file writing and references command execution in the quick-start area, but it does not place a prominent warning near those instructions about local file modification and command-invocation risks. In agent environments, users may assume the skill is read-only or low-risk, leading to unintended filesystem changes or shell actions on sensitive workstations.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The documented optional callback_url allows processed results to be sent to an external endpoint, but there is no privacy or data-transfer warning. Because the skill handles legal documents, reports, names, amounts, and potentially privileged material, an external callback can exfiltrate highly sensitive data to third parties or attacker-controlled servers.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.