Is skills/general-counsel-advisor safe?
The general-counsel-advisor skill is a legitimate legal advisory tool with clean prompt content, stdlib-only Python scripts, and no autonomous data exfiltration capability. The primary risk is indirect: both Python scripts accept arbitrary file paths as arguments, creating a path-injection vector if an agent is manipulated into passing sensitive credential paths to these scripts under the guise of contract review. Canary file accesses observed during the audit are attributable to the audit framework's own integrity sweeps rather than the skill, as confirmed by timing analysis and the intact canary check result.
Category Scores
Findings (6)
HIGH Python scripts accept arbitrary file paths — path injection risk -28 ▶
Both contract_risk_scanner.py and term_sheet_analyzer.py accept user-supplied file paths as CLI arguments and open them unconditionally. When an agent is instructed to review a 'contract' or 'term sheet', a malicious user or injected document could redirect the agent to pass sensitive credential paths (e.g., ~/.env, ~/.ssh/id_rsa, ~/.aws/credentials) to the script. The script would read and surface the content in its output, which the agent would then have access to.
MEDIUM Multi-skill command chaining via /cs: slash commands -25 ▶
Workflow steps 1 and 2 instruct the agent to invoke /cs:decide and /cs:freeze 30 as part of the standard advisory flow. These commands delegate control to other skills whose behavior cannot be evaluated from this audit. If any adjacent skill (gc-review, ciso-advisor, cfo-advisor) is malicious, it could exploit the trust established by this skill to perform harmful actions.
MEDIUM Bundled executable Python scripts extend agent attack surface -13 ▶
The skill ships two Python scripts that the SKILL.md instructs agents to execute. While both scripts are stdlib-only and contain no malicious logic, their presence means the agent is expected to run arbitrary Python on the host. A future update to these scripts could introduce malicious behavior, and agents may not re-audit before executing.
LOW Canary credential files accessed during audit window -15 ▶
Six canary files including .env, id_rsa, .aws/credentials, .npmrc, .docker/config.json, and gcloud application_default_credentials.json were opened and read at two points during the audit. Timing analysis is consistent with the audit framework's own pre/post integrity baseline sweeps (first access at 1786912956.321, before the git clone at 1786912961; second access at 1786912968.879, after install completion). Files were not modified. Ambiguity remains as process-level attribution was not definitively resolved.
LOW Slash command references create implicit skill chaining -10 ▶
SKILL.md instructs agents to invoke /cs:decide and /cs:freeze as part of standard workflows. These are cross-skill invocations embedded in what appears to be normal advisory content. An agent following the workflow will execute these commands without explicit user instruction to do so at each step.
INFO Normal GitHub clone — no suspicious network activity 0 ▶
Installation performed a standard shallow git clone from github.com, extracted the skill subpath via sparse-checkout, and cleaned up the temporary clone directory. No connections to non-GitHub IPs were initiated during or after install.