legal-data-hunter-pl
Fail
Audited by Gen Agent Trust Hub on Jul 14, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructions direct the agent to clone an external third-party repository (
https://github.com/worldwidelaw/legal-sources.git) and run its scripts (runner.py) using Python. Executing code from an unverified external source is a high-risk activity that can lead to arbitrary command execution on the host system.\n- [EXTERNAL_DOWNLOADS]: The skill relies on fetching core framework code and legal data collectors from a non-trusted external GitHub repository. This introduces a supply chain risk where the remote code could be modified to include malicious behavior.\n- [DATA_EXFILTRATION]: The skill documentation notes that internal components (common/pdf_extract.py) and search functionalities interact with a remote database hosted on Neon and a hosted API (legaldatahunter.com). While the skill provides explicit warnings to users to avoid these services to protect data privacy, the presence of these network-dependent features in the underlying harvesting logic creates a surface for data leakage to third-party infrastructure.\n- [COMMAND_EXECUTION]: The skill makes extensive use of theBashtool to perform repository management tasks (git clone, sparse-checkout) and to invoke the Python harvesting scripts. This automated execution of shell commands, especially when combined with external code, increases the risk of system compromise.\n- [PROMPT_INJECTION]: The skill is designed to ingest and process large quantities of unstructured legal data from various government portals, creating an indirect prompt injection surface:\n - Ingestion points: Fetches documents and API responses from official Polish legal portals (e.g., SAOS, Sejm ELI) via collectors in
sources/PL/.\n - Boundary markers: No explicit markers are used to isolate the harvested text or instruct the agent to ignore instructions embedded within the data.\n
- Capability inventory: The skill has access to
Bash(scripting),Write(file system access), andWebFetch(network operations).\n - Sanitization: There is no documentation of sanitization processes to filter out malicious content or instructions within the retrieved legal documents.
Recommendations
- AI detected serious security threats
Audit Metadata