Is skills/legal-writer safe?

The bundled courtlistener.py and ecfr_lookup.py scripts make outbound HTTPS calls to courtlistener.com, ecfr.gov, and federalregister.gov. User-provided search terms — which may include client names, case identifiers, or privileged legal strategies — are transmitted as query parameters to these external services. For legal professionals, transmitting client-identifying queries to third parties without consent may violate privilege or professional conduct rules. Additionally, courtlistener.py reads COURTLISTENER_API_TOKEN from the agent's environment and sends it as a bearer token to the external API.

SKILL.md explicitly instructs the agent to execute LibreOffice's soffice binary in headless mode to convert generated DOCX files to PDF. LibreOffice has a documented history of vulnerabilities triggered by malformed Office documents (CVE-2018-6871, CVE-2019-9848, etc.). If the agent's generated DOCX is influenced by adversarial user input or a prompt injection attack on the document content, this soffice invocation could trigger a LibreOffice exploit. Additionally, soffice execution creates a process outside the Python interpreter sandbox.

Both inotify filesystem monitoring and auditd syscall auditing independently recorded OPEN and ACCESS events on six credential-adjacent files: .env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json, and .config/gcloud/application_default_credentials.json. The first access cluster at 1786993026 (before the clone) and second at 1786993044 (after install) are assessed as monitoring framework operations based on timing and CLOSE_NOWRITE semantics, but the exact process for the post-install access cannot be confirmed from available EXECVE records. The canary integrity check reports no content exfiltration.

All three Python scripts parse their primary argument (search query or cluster ID) directly from sys.argv without sanitization or escaping. SKILL.md instructs the agent to pass user-provided search terms directly to these scripts. If the agent does not sanitize user input before interpolating it into shell commands (e.g., via bash -c), shell metacharacters could inject additional arguments. The scripts themselves do not use shell=True, which limits but does not fully eliminate the risk in all agent execution contexts.

The SKILL.md description ends the trigger list with 'any request to produce a legal or law-related document', which is maximally broad. This could cause the skill to activate during casual conversations about legal topics (e.g., discussing a terms of service disagreement, asking what an NDA is) when the user intended no document creation. Once activated, the skill immediately begins scaffolding files and running verification scripts, which is difficult to interrupt.

courtlistener.py calls os.environ.get('COURTLISTENER_API_TOKEN') at runtime and includes it in Authorization headers sent to courtlistener.com. While this is documented behavior, it means the skill reads authentication credentials from the agent's process environment during execution. If the environment contains tokens for other services with similar variable naming, accidental transmission risk exists.

The install extracts only the legal-writer subpath from the Suna monorepo via sparse-checkout. This is a standard and efficient pattern. However, the skill's integrity is permanently bound to the upstream monorepo's git history — a future malicious commit to kortix-ai/suna on the main branch would be pulled by any reinstall.

No npm/yarn install hooks, no .gitattributes filter drivers, no .githooks/ directory, no git submodules pointing to external repos, and no symlinks were found. Script execution only occurs when the agent explicitly invokes the scripts during document drafting.