defense lawyer

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:48 AM UTC
• Version: 1.0.0

Overview

This looks like a legitimate criminal-defense assistant, but it handles highly sensitive legal case data through an unpinned external Python package without clear privacy or data-flow safeguards.

Review carefully before installing. Use a virtual environment or sandbox, verify the package source and version, and avoid entering real client names, privileged facts, evidence, or detention/confession details unless you are in an approved secure environment. Treat generated filings as drafts requiring licensed attorney review.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: skill.md:6

Finding

Unpinned External Package Installation Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: skill.md:6 and readme.md:31-38
Vulnerability Type: Unpinned and unverified third-party dependency installation
Risk Level: Medium

Vulnerable Code

skill.md:6:

text

metadata: {"clawdbot":{"emoji":"⚖️","tags":["defense","lawyer","criminal","legal","china","evidence","sentencing","strategy","case-analysis","legal-documents"],"requires":{"bins":["python3"],"env":[],"config":[]},"install":["pip install openclaw-defense-lawyer"],"os":["darwin","linux","win32"]}}

readme.md:31-38:

bash

# Install from source
pip install openclaw-defense-lawyer

# Or clone repository
git clone https://github.com/ZhenRobotics/openclaw-defense-lawyer.git
cd openclaw-defense-lawyer
pip install -e .

Technical Analysis

The Skill directs users or an Agent runtime to install openclaw-defense-lawyer from PyPI without pinning an exact version or validating package hashes. It also offers installation from the mutable default branch of a Git repository without specifying an immutable commit.

The audited project contains only documentation and Skill metadata. It does not contain the referenced package implementation, a lockfile, verified package hashes, a dependency manifest, or a pinned repository commit. Consequently, the code ultimately installed and its transitive dependencies are outside the reviewed artifact and can change after this Skill has been audited.

Python package installation can invoke package build or installation behavior. After installation, the package is imported and used to process criminal-case facts, client identities, detention information, evidence, and generated legal documents. If the package, repository, release process, or a transitive dependency is compromised, attacker-controlled code could execute with the permissions of the user running pip or the application.

This finding establishes an insecure dependency acquisition mechanism. ...[truncated 1850 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a reviewed, exact version rather than accepting the latest available release.
2. Generate and verify cryptographic hashes for the package and all transitive dependencies, using a hash-locked requirements file and pip install --require-hashes.
3. If installation from Git is required, reference a reviewed immutable commit hash rather than a mutable branch or tag.
4. Vendor or include the package implementation in the reviewed artifact so its runtime behavior can be audited together with the Skill.
5. Maintain a fully resolved dependency lockfile and continuously scan direct and transitive dependencies for malicious releases and known vulnerabilities.
6. Install and execute the package in an isolated virtual environment, container, or sandbox under a least-privilege account.
7. Restrict filesystem and network access to only what is necessary for local legal analysis.
8. Document whether case data is processed locally or transmitted externally, and require explicit authorization before transmitting sensitive legal records.
9. Verify package ownership, signed releases, provenance attestations, and release-workflow integrity before approving upgrades.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README presents a criminal-defense assistant that processes highly sensitive legal case facts, client details, and evidence, yet the description and usage examples do not prominently address privacy, retention, consent, access control, or secure handling of generated files. In this context, omission of data-handling safeguards can lead users to paste confidential case materials into the tool or write generated defense documents to disk without appropriate protection, creating real confidentiality and compliance risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly instructs users to collect highly sensitive criminal case and defendant data, including identity, detention status, confession posture, and forgiveness/compensation details, but provides no privacy, minimization, retention, or secure-handling guidance at the point of collection. In a legal-defense context, this omission is dangerous because the data is unusually sensitive and often privileged; mishandling could expose defendants to confidentiality breaches, regulatory violations, or strategic harm in ongoing proceedings.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The workflow demonstrates passing sensitive case facts and client information directly into analysis and document-generation functions, culminating in defense documents, without embedding confidentiality safeguards or emphasizing mandatory human verification in the example itself. Although a general disclaimer appears elsewhere, the operational example normalizes automated processing of privileged legal data and may encourage users to generate filing-ready material from unverified inputs, increasing the risk of data leakage and harmful legal inaccuracies.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.