jd-lawsuit-skill

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:09 PM UTC
• Version: 1.0.2

Overview

The skill has a coherent consumer-dispute purpose, but it collects and stores sensitive order, payment, logistics, chat, invoice, and legal-document data without enough privacy controls.

Review this skill carefully before installing. It may work for Chinese e-commerce consumer disputes, but only use it if you are comfortable letting an agent view logged-in order pages and create local evidence files. Redact addresses, phone numbers, IDs, tracking numbers, payment details, and unrelated chat content where possible, choose a private storage location, and delete the evidence bundle when it is no longer needed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: references/evidence-collection.md:63
• Finding: Unprotected Plaintext Storage of Sensitive Consumer Evidence<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:34-35`; `references/evidence-collection.md:63-80`; `references/evidence-collection.md:111-144` **Vulnerability Type**: Plaintext storage of sensitive personal and transactional data **Risk Level**: Medium ### Vulnerable Code Snippets `SKILL.md:34-35` ```markdown 对关键页面截图、提取结构化数据，保存至 `~/Downloads/dispute-evidence/{订单号}/`， 自动生成证据清单索引。 ``` `references/evidence-collection.md:63-80` ```markdown ## 文件组织 ``` ~/Downloads/dispute-evidence/{订单号}/ ├── 01-order-detail.png ├── 02-product-snapshot.png ├── 02-product-snapshot-part2.png # 长页面分段 ├── 03-logistics.png ├── 04-after-sale.png # 可选 ├── 05-chat-record.png # 可选 ├── 06-current-product-page.png # 可选 ├── 07-price-history.png # 可选 ├── 08-reviews.png # 可选 ├── 09-invoice.pdf # 可选 ├── 10-seller-license.png # 可选 ├── evidence-index.md # 证据清单 └── raw-data.json # 结构化数据 ``` ``` `references/evidence-collection.md:111-144` ```json { "platform": "平台名称", "orderId": "123456789", "orderTime": "2026-03-15T10:30:00+08:00", "productName": "商品名称", "productPrice": 299.00, "paidAmount": 279.00, "paymentMethod": "在线支付", "orderStatus": "已完成", "logistics": { "company": "快递公司", "trackingNo": "SF1234567890", "signedAt": "2026-03-17T14:20:00+08:00", "timeline": [ {"time": "2026-03-17 14:20", "status": "已签收"}, {"time": "2026-03-17 08:30", "status": "派送中"}, {"time": "2026-03-16 22:00", "status": "到达本地分拣中心"} ] }, "seller": { "name": "店铺名称", "company": "公司全称（工商注册名）", "type": "自营/第三方" }, "snapshot": { "title": "快照中的商品标题", "description": "快照中的关键描述", "promises": ["7天无理由", "正品保证"] }, "afterSale": { "hasRecord": false, "records": [] } } ``` ### Technical Analysis The skill directs the agent to persist evidence in a predictable directory under `~/Downloads`. ...[truncated 2308 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Store evidence in an application-private directory instead of `~/Downloads`, and create directories and files with owner-only permissions such as `0700` and `0600`. 2. Encrypt evidence at rest using an operating-system credential store or a user-supplied encryption key. 3. Ask for explicit consent before collecting optional sensitive sources such as invoices, conversations, seller licenses, and payment information. 4. Apply data minimization by omitting fields not necessary for the selected complaint or legal document. 5. Redact delivery addresses, telephone numbers, payment identifiers, and unrelated conversation content from screenshots and exports. 6. Detect or warn when the destination is covered by cloud synchronization, shared folders, automated backup, or public indexing. 7. Replace order numbers in directory names with random identifiers to reduce discoverability. 8. Define a retention period and offer automatic secure deletion after document generation or case completion. 9. Clearly inform the user which files will be created, what sensitive data they contain, and who may be able to access them. 10. Validate permissions after file creation and stop with a warning if the destination cannot provide adequate protection. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (11)

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The guide tells users to upload evidence to the 12315 platform but does not warn them to minimize or redact sensitive personal data before submission. In a consumer-rights workflow, evidence often includes names, phone numbers, addresses, order IDs, and payment details, so omission of privacy guidance can lead to unnecessary exposure of personal information.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The 黑猫投诉 section encourages users to submit complaint text and screenshots without clearly warning that complaints are public-facing. Because this channel is specifically used for public pressure, users may unintentionally publish sensitive personal, transaction, or dispute details that can be indexed, copied, or misused by third parties.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The document instructs collection of highly sensitive consumer-dispute evidence, including order numbers, payment details, logistics records, chat logs, invoices, and seller identity data, but provides no minimization, consent, masking, retention, or access-control guidance. In this skill context, the data is directly tied to real individuals and transactions, so omission of privacy handling increases the risk of unnecessary exposure or misuse during evidence gathering.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The file prescribes saving screenshots, PDFs, and a structured raw-data.json under a predictable local directory, consolidating order, logistics, payment, and identity-related evidence without any warning about encryption, file permissions, or cleanup. In a legal-dispute workflow this centralizes sensitive material in an easily discoverable location, increasing the chance of local compromise, accidental sharing, or later unauthorized reuse.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The file is entirely framed as Chinese legal-document generation and explicitly states that all document output will be produced in Markdown, with the templates themselves fixed in Chinese. There is no indication that users may choose another language or that the Chinese-only constraint is an explicit opt-in or justified locale restriction.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The file recommends collecting customer-service chat records and merchant/operator identity information as evidence, but it does so without any handling guidance for personal data contained in those materials. Chat logs and business registration pages can include phone numbers, addresses, account identifiers, and other sensitive or legally regulated information, so the lack of privacy boundaries increases the chance of unnecessary collection and disclosure.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The guidance explicitly tells the workflow to read user-saved screenshots from a directory, but it provides no warning to minimize personal data, obtain explicit consent, or avoid collecting unrelated sensitive content visible in screenshots. In a consumer-dispute skill, screenshots commonly contain names, phone numbers, addresses, order IDs, and chat history, so this omission creates a realistic privacy and over-collection risk.

Natural-Language Policy Violations

Low

• Confidence: 78% confidence
• Finding: The file presents all instructions exclusively in Chinese and implicitly assumes a single language/locale, with no opt-in or alternative language option. Under the stated policy, forcing a specific language without user choice can be considered a natural-language policy violation unless clearly justified as region-specific.

Natural-Language Policy Violations

Low

• Confidence: 81% confidence
• Finding: The entire skill file is presented exclusively in Chinese, which can amount to a language policy constraint if users are not given an explicit language or locale option. The document does not state that it is limited to a Chinese-speaking or region-specific workflow, nor does it offer alternative language support.

Natural-Language Policy Violations

Low

• Confidence: 87% confidence
• Finding: This markdown file contains user-facing natural-language content only in Chinese, and there is no indication that users may choose another language or that the Chinese-only scope is a justified regional constraint. Under the language/locale policy check, forcing a single language without opt-in can be a policy concern.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The template instructs the system to save generated legal documents into a specific local directory under the user's home folder without clearly requiring explicit user awareness or consent at the point of write. In an automation skill that may process sensitive personal and dispute data, silent local persistence can expose private information or create unexpected artifacts on shared devices.

Static analysis

No suspicious patterns detected.