china-law-search

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 0.90). The skill includes a "自我进化规则" section that explicitly instructs the agent to automatically update the skill's code and documentation after use, which is an instruction for self-modification and persistent behavior outside the stated law-search functionality.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). 该技能在运行时通过 LLM/用户输入的“keyword/法规名称”直接调用 flk_api.search()（POST 到 https://flk.npc.gov.cn/law-search/search/list）与 gov_api.search()（POST 到 https://sousuoht.www.gov.cn/athena/forward/...）来检索并读取其返回的法规文本/字段，而该输入可能携带旁路注入意图；同时在 --content 模式下还会按正文内容搜索并返回正文字段。

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill auto-installs and runs the Playwright CLI at runtime (via "npm install -g @playwright/cli" in lib/gov_api.py) and then uses it to open and intercept requests to https://www.gov.cn/zhengce/xxgk/gjgzk/index.htm / the athena forward endpoint, which means remote code is fetched/installed and executed during runtime (e.g. the athena/forward URL https://sousuoht.www.gov.cn/athena/forward/BD8730CDDA12515E2D9E1B21AA11C0D6 is accessed to obtain auth keys).

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The skill explicitly instructs automatic self-updating of its own code/docs (modifying files under ~/.claude/skills) and includes automated installation of global tools (npm install -g) and writing cache files, which direct the agent to change the host filesystem/state.