corporate lawyer

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:48 AM UTC
• Version: 1.0.0

Overview

The skill is purpose-aligned as a corporate legal assistant, but it asks users to handle sensitive legal/business material while relying on unreviewed mutable Python installation sources.

Review this carefully before installing. Use it only in a sandbox or least-privileged environment, avoid root/admin installation, and do not provide confidential, privileged, personal, regulated, or client data unless you have verified the package source, data-handling terms, retention practices, and legal compliance. Treat generated legal output as informational and have qualified counsel review it.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: skill.md:6

Finding

Unpinned External Python Package and Repository Installation

Content

View full analysis

Vulnerability Details

File Locations:

• skill.md:6
• skill.md:103-110
• skill.md:270-277
• readme.md:33-40
• readme.md:303-310

Vulnerability Type: Unverified and mutable third-party dependency installation
Risk Level: Medium

Vulnerable Code

skill.md:6:

yaml

metadata: {"clawdbot":{"emoji":"⚖️","tags":["legal","corporate-lawyer","contract-review","transaction","compliance","m&a","business-law","commercial-law","risk-assessment","negotiation"],"requires":{"bins":["python3"],"env":[],"config":[]},"install":["pip install -e ."],"os":["darwin","linux","win32"]}}

skill.md:103-110 and duplicated at skill.md:270-277:

bash

# From PyPI
pip install openclaw-skill-corporate-lawyer

# From source
git clone https://github.com/ZhenRobotics/openclaw-corporate-lawyer.git
cd openclaw-corporate-lawyer
pip install -e .

readme.md:33-40 and duplicated at readme.md:303-310:

bash

# From PyPI (when published)
pip install openclaw-skill-corporate-lawyer

# From source
git clone https://github.com/ZhenRobotics/openclaw-corporate-lawyer.git
cd openclaw-corporate-lawyer
pip install -e .

Technical Analysis

The installation instructions retrieve and install Python code without pinning an immutable package version or Git commit and without supplying integrity hashes. The PyPI command resolves whatever release is selected at installation time, while the Git command clones the repository's current default branch. Consequently, the installed code can differ from the content that was reviewed.

The local artifact contains only readme.md and skill.md; it does not contain the advertised Python implementation. Therefore, the package source, build configuration, installation hooks, runtime code, and transitive dependencies cannot be verified as part of this audit.

Python package installation may execute build backend logic or other installation-related c ...[truncated 1992 chars]

Remediation

View remediation

Remediation Suggestions

1. Include the complete implementation and build configuration in the audited artifact so installation and runtime behavior can be reviewed.
2. Pin the PyPI dependency to a reviewed, immutable version rather than allowing unconstrained resolution.
3. Use a lockfile with cryptographic hashes and install with hash verification, such as pip install --require-hashes.
4. If installation from Git is necessary, pin a full reviewed commit hash rather than cloning the mutable default branch.
5. Verify release provenance through signed commits, signed tags, trusted publishing, or package attestations.
6. Pin and audit all transitive dependencies and use automated dependency and malware scanning in the release process.
7. Build and install in an isolated, least-privileged environment without production credentials or sensitive host mounts.
8. Avoid administrator or root installation and prohibit unreviewed package installation in privileged CI or production environments.
9. Ensure the metadata installation command refers only to source bundled with and verified as part of the skill artifact.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README promotes uploading contracts, transaction details, compliance materials, and other business records to an AI legal assistant, but it does not warn users against submitting sensitive, confidential, privileged, or regulated data. In a legal-assistance context, that omission is risky because users may reasonably provide highly sensitive client, corporate, or personal information without understanding retention, third-party processing, or privilege implications.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The activation criteria are very broad and include vague triggers such as general corporate/commercial law questions, compliance analysis, negotiation support, and drafting requests. In an agent environment, this can cause the skill to activate unintentionally on loosely related prompts, increasing the chance that the model adopts the skill’s legal-assistant behavior when the user did not explicitly request it, which may lead to inappropriate data collection, overconfident legal guidance, or workflow hijacking.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.