Claude Legal Skill

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:59 AM UTC
• Version: 1.0.0

Overview

This is a coherent contract-review guide skill with no bundled executable payload; the main caveat is an optional unpinned external GitHub tool install for generating redline files.

Install only if you want an AI assistant to analyze contracts and suggest negotiation language. Treat outputs as first-pass legal analysis, not legal advice. If using the optional legal-redline-tools workflow, review or pin the external repository first and run it in a dedicated environment because pip installs from mutable GitHub sources can execute code.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:65

Finding

Unpinned Third-Party Package Installation from a Mutable Git Repository

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 65–73
Vulnerability Type: Supply-chain risk caused by an unpinned VCS dependency
Risk Level: Medium

Vulnerable Code

markdown

### Generate Deliverables with legal-redline-tools

This skill outputs structured JSON redlines. To produce the tracked-changes Word docs and redline PDFs that lawyers actually send, pair with [**legal-redline-tools**](https://github.com/evolsb/legal-redline-tools):

```bash
pip install git+https://github.com/evolsb/legal-redline-tools.git

# After the skill generates redlines.json:
legal-redline apply contract.docx redlined.docx \
    --from-json redlines.json \
    --pdf redline.pdf \
    --memo-pdf internal-memo.pdf

Technical Analysis

The installation command retrieves and installs Python package code from the external repository's mutable default branch. It does not pin the dependency to an immutable commit, verify an expected artifact hash, or otherwise establish that the installed revision is the one that was previously reviewed.

Python package installation can execute package-controlled build and installation logic. The installed CLI also subsequently processes contract documents and generated redline data. Because the external dependency is not included in this project, its implementation and security properties were outside the audited artifact and could not be verified.

This is a supply-chain weakness rather than evidence that the referenced repository is currently malicious. The risk arises because the effective installed payload can change after this project has been reviewed.

Attack Path

1. An attacker compromises the external repository, a maintainer account, or the repository's default branch.
2. The attacker adds malicious package build logic or modifies the legal-redline CLI.
3. A user follows the README and runs:

   bash

   pip install git+https://github.com/evolsb/legal-redline-tools.git
   

4. pip retrieves the c ...[truncated 1272 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a reviewed, immutable commit:

   bash

   python -m pip install \
     "legal-redline-tools @ git+https://github.com/evolsb/legal-redline-tools.git@<full-reviewed-commit-sha>"
   

2. Prefer a versioned release from a trusted package registry instead of installing the mutable default branch.

3. Publish and verify cryptographic hashes for release artifacts. Use hash-enforced dependency installation where supported.

4. Lock all transitive dependencies and review the dependency lock file before release.

5. Recommend installation in a dedicated virtual environment under a non-privileged account:

   bash

   python -m venv .venv
   . .venv/bin/activate
   python -m pip install --upgrade pip
   

6. In the README, explicitly state that legal-redline-tools is a separate, externally maintained component that is not part of this audited Skill.

7. Review the pinned external revision, including package build configuration and runtime handling of contract files, before recommending it.

8. Add automated dependency monitoring and require reviewed pull requests before updating the pinned revision.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

YARA rule 'agent_skill_remote_bootstrap_execution': Remote script or code download followed by execution/bootstrap installation [agent_skills]

High

• Category: YARA Match
• Confidence: 85% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · README.md (reported line 68)May include surrounding context.

ions** with suggested language to add

• Internal consistency checks (broken cross-references, undefined terms)

Generate Deliverables with legal-redline-tools

This skill outputs structured JSON redlines. To produce the tracked-changes Word docs and redline PDFs that lawyers actually send, pair with legal-redline-tools:

bash

pip install git+https://github.com/evolsb/legal-redline-tools.git

# After the skill generates redlines.json:
legal-redline apply contract.docx redlined.docx \
    --from-json redlines.json \
    --pdf redline.pdf \
    --memo-pdf internal-memo.pdf

---

Features

Position-Aware Review

Tell it which party you are (customer, vendor, buyer, seller, receiving party) — the skill adjusts what it flags as risky.

Document Type Checklists

Specialized checklists for each contract type:

• NDA — confidentiality term, non-solicitation, standstill, destruction cert

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The invocation example "Review this NDA - I'm the receiving party" is phrased as general natural language rather than a narrowly scoped command, and the README does not define clear activation boundaries or exclusion conditions. Similar broad examples are repeated later, increasing the chance the skill could match commonplace requests instead of an explicitly constrained trigger.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README provides several free-form examples such as "Analyze the indemnification in this MSA" and "What are the termination provisions?" but never explains what exact wording, context, or file attachment conditions are required for activation. Without explicit scope or negative examples, these prompts are broad enough to overlap with normal conversation about contracts.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · examples/nda-review.md (reported line 102)May include surrounding context.

md

4. **Hidden restrictive covenants** — Non-compete, non-solicit buried in NDA
5. **No residuals clause** — Can't use general knowledge gained
6. **Pre-agreed injunctive relief** — Specific performance without bond
7. **Broad assignability** — Other party can assign without consent

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger prompt 'Review this SaaS agreement. I'm the customer.' is generic enough to overlap with normal user requests for contract analysis, which increases the chance the skill activates unintentionally or too broadly. In an agent setting, broad activation can cause the skill to take over benign conversations, misroute user intent, or process sensitive legal documents when the user did not explicitly intend to invoke this specific workflow.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The activation conditions are broad enough to trigger on generic legal-help requests such as 'review contract' or 'check this contract' without requiring stronger signals like an explicit document upload, contract text, or confirmation that the user wants contract analysis. In a multi-skill agent, this can cause overbroad routing, unintended handling of sensitive legal documents, or the skill responding outside its intended scope.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.