lvdian-legal-search
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses local Python scripts (
scripts/preflight_check.py,scripts/flk_search.py,scripts/validate_output.py) to automate legal database searches, verify network connectivity, and validate the final output format against established 'Iron Rules'. The test suite also utilizessubprocess.runto verify script functionality locally. - [INDIRECT_PROMPT_INJECTION]: The skill processes legal metadata and text retrieved from external sources like the National Laws and Regulations Database and Northlake Law (Pkulaw). It mitigates risks associated with untrusted data through a mandatory evidence chain:
- Ingestion points: External API responses from
flk.npc.gov.cnand MCP-derived content. - Boundary markers: The skill enforces the use of specific markdown templates and explicit instructions to cross-reference multiple official sources.
- Capability inventory: Uses local script execution for specific search and validation tasks.
- Sanitization: Implements HTML tag stripping in
flk_search.pyand a domain blacklist invalidate_output.pyto prevent referencing untrusted third-party legal forums. - [EXTERNAL_DOWNLOADS]: The skill establishes network connections to official Chinese government domains (
flk.npc.gov.cn,www.gov.cn) to retrieve legal documents and verify validity. These connections are performed viaurllib.requestwithin scripts to fetch authoritative metadata. - [SAFE]: No evidence of credential exfiltration, obfuscation, or persistence mechanisms was found. The skill's design focuses on reliability and authoritative sourcing for legal research.
Audit Metadata