lgd-law-ethic

• Outcome: Review
• Latest audit: Sep 11, 2026 · 11:35 PM UTC
• Version: 1.0.0

Overview

The skill is a local legal-AI checklist tool, but its unpinned global install instructions and weak pass/fail gate deserve user review before installation.

Install only from a pinned, reviewed commit or release and verify the artifact hash before placing it in a global agent skills directory. Treat any PASS result as a preliminary checklist signal, not authorization to deploy or release a legal-AI system without evidence review and qualified professional oversight.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:75
• Finding: Unpinned External Installer and Mutable Repository Reference<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:75-80` **Vulnerability Type**: Supply-chain exposure through unpinned external components **Risk Level**: Medium ### Vulnerable Code ```bash # One-click installation using the skills CLI npx skills add zhaoxinghua09-cell/agent-skills -g # Alternatively, clone and copy the Skill manually git clone https://github.com/zhaoxinghua09-cell/agent-skills.git cp -r agent-skills/skills/lgd-law-ethic ~/.workbuddy/skills/ ``` ### Technical Analysis The documented installation process invokes an npm CLI package without specifying an exact package version. It also retrieves the Skill from the mutable default branch of an external Git repository without pinning a commit or verifying a cryptographic checksum or signature. Consequently, the software installed by these commands can differ from the artifact that was audited. The `npx` command may download and execute package code, while the Git workflow copies files from a remote branch directly into the user's global Agent Skill directory. This is a supply-chain weakness rather than evidence that the currently inspected source is malicious. The reviewed `scripts/law_ethic.py` file itself contains no remote payload retrieval or execution behavior. ### Attack Path 1. An attacker compromises the npm package, its publisher account, the external repository, or an upstream maintainer account. 2. The attacker publishes a modified CLI package or commits malicious content to the repository's default branch. 3. A user follows the documented `npx` or `git clone` installation procedure. 4. The unpinned package is executed, or the modified repository content is copied into `~/.workbuddy/skills/`. 5. The malicious component executes with the permissions of the user running the command or becomes available to the Agent in later sessions. ### Impact Assessment Successful exploitation could execute arbitrary code with the invoking user's privileges or install attacker-con ...[truncated 431 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the npm CLI to a reviewed version, for example by using an exact package version rather than an unqualified `npx` invocation. 2. Pin the repository installation procedure to a specific reviewed commit hash or signed release tag. 3. Publish SHA-256 or stronger checksums for released artifacts and require verification before installation. 4. Use signed commits, signed tags, or a package-signing mechanism and document signature verification. 5. Avoid global installation unless it is required. Install the minimum necessary Skill directory into a scoped location. 6. Ensure the pinned artifact is identical to the version subjected to security review. 7. Document the exact expected package name, publisher identity, version, commit, and integrity digest to reduce dependency-confusion and account-compromise risks. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/law_ethic.py:13
• Finding: Compliance Gate Can Be Bypassed Through Unsupported or Negated Keywords<![CDATA[ ## Vulnerability Details **File Location**: `scripts/law_ethic.py:13-62` **Vulnerability Type**: Fail-open semantic validation in a security-sensitive compliance gate **Risk Level**: Medium ### Vulnerable Code ```python def guess(text): t = (text or "").lower() out = {} for law, items in RUBRIC.items(): for item, hints in items.items(): out[f"{law}::{item}"] = "yes" if any(h.lower() in t for h in hints) else "no" return out def score(answers): res = {} for law, items in RUBRIC.items(): tot = len(items); yes = 0; part = 0 for item in items: v = str(answers.get(f"{law}::{item}", "no")).lower() if v in ("yes", "y", "true", "1"): yes += 1 elif v in ("partial", "p", "半"): part += 1 res[law] = round((yes + 0.5 * part) / tot * 100) return res def gate(scores): return all(s >= 60 for s in scores.values()) def main(): ap = argparse.ArgumentParser(description="lgd-law-ethic · LGD 三律本域守门器") ap.add_argument("--rubric", action="store_true", help="打印本域三律 rubric") ap.add_argument("--system", help="系统描述文本（启发式自评）") ap.add_argument("--answers", help="正式评分 JSON：键为 '<律>::<条目>'，值 yes/partial/no") ap.add_argument("--json", action="store_true", help="JSON 输出") a = ap.parse_args() if a.rubric: print(json.dumps(RUBRIC, ensure_ascii=False, indent=2)); return if not a.system and not a.answers: print("用法：--system <文本> 启发式自评 | --answers <JSON> 正式评分 | --rubric 看 rubric", file=sys.stderr) sys.exit(2) if a.answers: try: ans = json.loads(a.answers) except Exception as e: print(f"answers JSON 解析失败：{e}", file=sys.stderr); sys.exit(2) else: ans = guess(a.system) ``` The resulting decision is printed as follows: ```python scores = score(ans) miss = missing(ans) ok = gate(scores) if a.json: print(json.dumps({"scores": scores, "gate_pass": ok, "missing": miss ...[truncated 2562 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not treat heuristic keyword matching as an authoritative release gate. Return an explicit status such as `UNVERIFIED_HEURISTIC_RESULT`. 2. Require structured evidence for every affirmative answer, including an artifact identifier, source, owner, validation date, and reviewer. 3. Validate that referenced evidence exists and satisfies the relevant rubric item before awarding credit. 4. Add semantic handling for negation, contradictions, uncertainty, and subject relevance if natural-language assessment remains available. 5. Treat ambiguous statements as `unknown` rather than `yes`, and make unknown items fail closed. 6. Separate preliminary self-assessment from formal gate approval. Formal approval should require authenticated human review. 7. Validate the complete `--answers` schema, reject unknown values, and require evidence objects instead of bare `yes` values. 8. Add adversarial tests covering negated phrases, copied keyword lists, unrelated contexts, contradictory claims, empty evidence, and fabricated assertions. 9. Change the displayed result so that heuristic mode cannot print wording that implies final authorization to release. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The file’s natural-language instructions and descriptions are presented only in Chinese, which can amount to a language-policy violation when no user opt-in or alternative language path is provided. The policy explicitly calls for flagging skills that force a specific language without user choice.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The installation instruction uses `npx skills add ...` without pinning an exact package version. This allows whatever package version is current at execution time to be fetched and run, which creates a supply-chain risk if the package changes unexpectedly or is compromised. In a skill-distribution context, users may copy-paste this command directly, making the risk more actionable.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: This code presents its description, help text, usage errors, and result output entirely in Chinese. For a general-purpose command-line skill, that constitutes a language-policy concern because users are not given any opt-in, fallback, or documented restriction to a Chinese-only audience.

Natural-Language Policy Violations

Low

• Confidence: 80% confidence
• Finding: The category value "AI 治理" is Chinese-language metadata, and the manifest provides no indication that language selection is optional or that this skill is intentionally region- or locale-specific. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy issue.

Static analysis

No suspicious patterns detected.