China Contract Review

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 3:35 AM UTC
• Version: 1.0.0

Overview

This is a narrowly scoped Chinese contract review skill with a disclosed but unpinned document-processing dependency.

Before installing, understand that this skill is intended for Chinese-language contracts under China-law context and should not replace a lawyer. Install the dependency in an isolated environment if possible, and prefer a pinned, reviewed `python-docx` version for stronger supply-chain control.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:7
• Finding: Unpinned Third-Party Python Dependency## Vulnerability Details **File Location**: `SKILL.md`, line 7 **Vulnerability Type**: Unpinned and unhashed third-party dependency installation **Risk Level**: Medium **Complete Code Snippet**: ```yaml dependencies: "pip install python-docx" ``` ### Technical Analysis The skill declares a direct `pip install` command for `python-docx` without specifying an exact version, cryptographic integrity hashes, or a trusted package source. Package resolution therefore depends on mutable content supplied by the configured Python package index at installation time. Python package installation can execute package-controlled build or installation logic. If the package distribution, package-index account, configured mirror, or dependency chain is compromised, an attacker-controlled release could execute code during installation. Future releases may also introduce incompatible or vulnerable behavior without any change to this reviewed project. The audited project contains only `SKILL.md` and `LICENSE.txt`; no included script uses `python-docx`. The dependency may therefore be unnecessary. No evidence was found that the current `python-docx` package is malicious, so exploitation depends on a supply-chain or package-source compromise. ### Attack Path 1. A user or automation system installs the skill and processes its dependency declaration. 2. The command `pip install python-docx` queries the installer’s configured package index or mirror. 3. Because no version or hash is specified, `pip` resolves mutable package content available at that time. 4. An attacker compromises the package, its release account, a transitive dependency, or the configured package source and publishes or serves a malicious distribution. 5. The installer downloads the attacker-controlled distribution. 6. Package-controlled build or installation behavior executes with the privileges and network access of the process performing the installation. ### Impact Asse ...[truncated 565 chars]
• Remediation: ## Remediation Suggestions 1. Remove `python-docx` from the skill metadata if it is not required; no included executable code currently uses it. 2. If required, pin the dependency to a specifically reviewed version, for example through a version-locked requirements file. 3. Require cryptographic hashes using a command such as `pip install --require-hashes -r requirements.txt`. 4. Record and lock transitive dependencies so their versions cannot change unexpectedly. 5. Install packages only from an explicitly configured, trusted package index or an internally controlled artifact repository. 6. Perform dependency installation in an isolated virtual environment or container under a non-privileged account. 7. Add automated vulnerability, provenance, and integrity checks for dependency updates before changing the lock file.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Scope Creep

Low

• Category: Excessive Agency

Content

permit persons to whom the Software is furnished to do so.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE
FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER

• Confidence: 70% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: The markdown explicitly states '支持中文合同审查', which indicates the skill is limited to Chinese-language contract review. Under the policy for natural-language violations, locale or language constraints should either offer user choice or be clearly documented and justified as region-specific.

Static analysis

No suspicious patterns detected.