Legal Docs Pro

Your landlord just sent a 12-page lease renewal and you have no idea what half the clauses mean. Or you need an NDA for a freelancer by tomorrow and LegalZoo...

What to consider before installing: - Data storage: The skill stores your business profile (including EIN, addresses, emails) in plaintext under the skill's config/data directories and will auto-save generated documents and contract-review copies to local folders (data/documents, data/reviews) and the local dashboard tables. If you don’t want that behavior, inspect or edit SKILL.md and scripts to disable autosave or remove sensitive fields before using. - Model data exposure: Contract text you paste into the agent is processed by the underlying AI provider. Review your AI provider's privacy/data-handling policies before sending highly confidential material (M&A, litigation, proprietary trade secrets). The skill’s SECURITY.md correctly calls this out. - Scripts to review: The package includes shell scripts (setup.sh, export-doc.sh, contract-scan.sh). contract-scan.sh is benign and only extracts text and optionally saves a local copy; export-doc.sh and setup.sh contents should be reviewed before execution to ensure they don't perform unexpected network operations. Do not run scripts you haven't inspected. - Required tools: PDF/.docx extraction and PDF export rely on external tools (poppler/pdftotext, pandoc, textutil). Install these from trusted package managers if needed; the scripts fail safely if absent. - File permissions & isolation: After setup, restrict access to the skill data directory (chmod 700 config/ or the whole skill directory) and consider running the skill on a machine you control. If you want extra safety, run first use in an isolated environment (VM) and verify file writes. - When in doubt: Do not paste highly sensitive contracts or tax IDs until you’ve inspected setup.sh and export-doc.sh for network calls, and confirm you are comfortable with local storage behavior. If you need absolute confidentiality, consult a licensed attorney rather than relying solely on AI-generated reviews.

Type: OpenClaw Skill Name: normieclaw-legal-docs-pro Version: 1.0.3 Legal Docs Pro is a legal document generation and review tool that handles sensitive business information, including EINs and contract details. It is classified as suspicious due to shell injection vulnerabilities in `scripts/setup.sh` and `scripts/contract-scan.sh`, where user-provided inputs (such as business names or filenames) are directly interpolated into Python command strings executed via the shell. While these scripts and the collection of business data in `config/settings.json` are plausibly necessary for the tool's stated purpose, the insecure implementation and the handling of sensitive identifiers pose a risk of arbitrary code execution and data exposure.