legal-norm-validity-check
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: No malicious prompt injection patterns were detected. The instructions use 'IMPORTANT' and 'CRITICAL' markers solely to emphasize legal accuracy and the necessity of using verified data sources rather than model memory. There are no attempts to bypass safety filters or override system instructions.
- [DATA_EXFILTRATION]: The skill does not access sensitive local files or hardcode credentials. It instructs users on how to safely configure their own API tokens for third-party services within their local environment, advising against committing secrets to the skill files. It references well-known and official legal domains (pkulaw.com, npc.gov.cn) which is consistent with its stated purpose.
- [EXTERNAL_DOWNLOADS]: The skill does not perform automated downloads or execute remote scripts. It provides configuration guidance for connecting to external Model Context Protocol (MCP) servers provided by well-known legal information services (PKULaw), which is a standard platform feature.
- [INDIRECT_PROMPT_INJECTION]: The skill is specifically designed to mitigate risks associated with untrusted data (potentially inaccurate or fabricated legal citations). It establishes a 'Data Source and Tool Call Agreement' that prioritizes verification through external tools over internal model processing, effectively acting as a defense mechanism against hallucination and data-driven errors.
- [COMMAND_EXECUTION]: No dangerous shell commands or subprocess executions were found. The skill operates within the agent's logic to process legal information using defined methodologies.
Audit Metadata