Court Prep
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The main court-prep guide is simple, but a bundled helper script stores local notes/history and advertises removal without actually deleting stored data.
This is not showing exfiltration or destructive behavior, but review it before use. If you install or run it, verify which script is actually invoked, avoid entering sensitive case facts into the generic add/list/search/export helper unless you want them stored locally, and manually check the court-prep data directory if you need to delete prior entries.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Sensitive case details entered into the helper could remain on disk in the court-prep data directory.
This script creates persistent local storage and appends user-provided entries plus command history. For a court-preparation skill, those entries could contain sensitive legal facts, but SKILL.md primarily describes stdout summaries rather than persistent storage.
DATA_DIR="${COURT_PREP_DIR:-${XDG_DATA_HOME:-$HOME/.local/share}/court-prep}"
DB="$DATA_DIR/data.log"
mkdir -p "$DATA_DIR"
...
cmd_add() {
echo "$(date +%Y-%m-%d) $*" >> "$DB"; echo " Added: $*"
_log "add" "${1:-}"
}Do not enter sensitive case details unless you are comfortable with local storage. The maintainer should clearly disclose storage behavior, minimize logging, and provide a clear delete/clear-data command.
A user may believe sensitive legal notes were deleted when they actually remain in the local data log.
The `remove` command reports that something was removed, but the function does not modify or delete the stored data file.
cmd_remove() {
echo " Removed: $1"
_log "remove" "${1:-}"
}Implement real deletion or rename the command so it does not imply data removal; document how users can verify and clear stored data.
Users may not know which script is intended to run or what local requirements are needed.
The package nevertheless includes runnable shell scripts and SKILL.md tells users to run `court-prep`, so the install/runtime mapping is unclear even though no automatic execution is shown.
No install spec — this is an instruction-only skill.
Provide an install spec or documentation that maps `court-prep` to the intended script and declares required local tools such as bash/python3.