본문으로 건너뛰기
cccskills
무료GitHub에 공개

public-legal-ai-endpoint-protection

Reviews public or shared AI-backed web endpoints for abuse, excessive cost, data exposure, unsafe browser control, weak request limits, and missing human approval. Use before launching or materially changing an HTTP or API endpoint that can invoke an AI model. Do not use as a penetration test, compliance certification, or substitute for runtime monitoring and professional security review.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

lawve-ai/awesome-legal-skills

실행 점수 미검증

설치 방법 보기

포함된 파일(3)

  • SKILL.md4.0 KB
  • agents/openai.yaml240 B
  • README.md1.1 KB

SKILL.md(원문)

설치하기 전에 에이전트에게 전달되는 지시 내용을 확인할 수 있습니다.

Public Legal-AI Endpoint Protection by Ignacio Adrián Lerer

Public-light endpoint review method by Ignacio Adrián Lerer.

Review the design and configuration without probing a live third-party system. Use local code, documentation, synthetic requests, or an authorized test environment.

Review workflow

  1. Map the request path from caller to model provider and back.
  2. Identify who can call the endpoint, what data they can supply, and which costly or sensitive actions they can influence.
  3. Verify that authorization and abuse controls run before any paid model call.
  4. Check the minimum controls below.
  5. Record missing evidence separately from confirmed defects.
  6. Return PASS, REVIEW, or BLOCK and the smallest safe remediation.

Minimum controls

  • Accept only intended HTTP methods and content types.
  • Enforce authentication or a documented public-use policy.
  • Restrict allowed origins when browser access is intended.
  • Apply per-user or per-client rate and concurrency limits.
  • Cap request size, history length, output size, duration, and retry count.
  • Select models and tools on the server, not from unrestricted browser input.
  • Keep secrets and provider credentials outside client-visible responses.
  • Validate and normalize user-controlled fields before provider calls.
  • Return sanitized errors without upstream request details or sensitive diagnostics.
  • Record enough metadata to investigate abuse without logging confidential content by default.
  • Define spend alerts, a kill switch, and a rollback path.
  • Require explicit human approval before expanding permissions, data access, external actions, or budget.

Decision states

  • PASS: minimum controls are evidenced and remaining risk fits the declared public-use policy.
  • REVIEW: evidence is incomplete or a non-critical control needs a named owner and deadline. Do not claim production readiness.
  • BLOCK: an unauthenticated or browser-controlled request can cause uncapped spending, expose sensitive data, select unrestricted tools/models, or trigger consequential external actions.

Output

## Public AI Endpoint Protection Receipt

Endpoint and intended users:
Evidence reviewed:
Decision: PASS | REVIEW | BLOCK

### Request path
- Caller:
- Server controls:
- Model or tool boundary:
- Returned data:

### Findings
- Confirmed:
- Missing evidence:
- Highest plausible impact:

### Required controls
- [control, owner, verification]

### Human approval points
- [action requiring approval]

### Recheck triggers
- [code, provider, permission, model, tool, or budget change]

Verification and fallback

Verify controls from source, configuration, or an explicitly authorized test environment. Do not probe external systems, bypass access controls, or run load tests merely because this Skill was invoked.

If the deployment or configuration cannot be inspected, return REVIEW or BLOCK. Do not infer safety from a framework, hosting provider, or security product name.

Trigger tests

  • Obvious: “Review this public AI API before launch.”
  • Paraphrased: “Could a visitor make our chatbot spend without limit?”
  • Changed system: “We added tools and a larger model to the endpoint. Recheck it.”
  • Non-trigger: “Draft the marketing copy for our legal-tech homepage.”

Public boundary

This edition contains a general educational checklist only. Do not include credentials, private configurations, internal prompts, client data, local paths, proprietary thresholds, provider routing, cost ledgers, private evaluations, or exploit instructions.

리뷰

아직 리뷰가 없습니다. 사용해 본 소감을 남겨 주세요.

댓글

로그인 없이 쓸 수 있습니다. 사용 후기, 질문, 작동하지 않은 환경 등을 편하게 남겨 주세요.

아직 댓글이 없습니다. 첫 댓글을 남겨 보세요.

보내면 바로 공개됩니다. 이메일 주소나 전화번호 같은 개인 정보는 쓰지 마세요. URL은 2개까지입니다.

0 / 1,000자

이 양식은 reCAPTCHA로 보호되며 Google 개인정보처리방침 및 서비스 약관이 적용됩니다.

같은 저장소의 스킬

adjudicative-ai-impartiality-challenge

무료

Public-safe preliminary screen for challenges to the impartiality of an AI evaluator, LLM-as-a-judge, decision-support agent, or adjudicative system based on prior outputs, suspected bias, unstable reasoning, or self-reinforcing memory. Use when asked whether an AI should be recused, disqualified, replaced, audited, or escalated. Does not decide real cases or claim that human judicial-recusal doctrine automatically applies.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

lawve-ai/awesome-legal-skills8952026년 10월 20일 업데이트

agent-authority-charter-builder-arkadiy-miteiko

무료

Creates an Agent Authority Charter for enterprise or regulated AI agents before deployment. Use this Skill when a user needs to define what an AI agent is allowed to do, who delegated authority to it, what actions are permitted or prohibited, when human approval is required, what evidence must be preserved, and how the agent can be suspended, revoked, or escalated.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

lawve-ai/awesome-legal-skills8952026년 10월 20일 업데이트

ai-act-knowledge

무료

EU AI Act Knowledge Engine — authoritative regulatory Q&A grounded in 70 official EU source documents (including the 2026 Commission draft guidelines on Art. 6 high-risk classification — general principles, Annex I, Annex III). Answers any question about the AI Act with article-level citations from the full regulation text, Commission guidelines, EDPB/EDPS opinions, codes of practice, harmonised standards, FRIA guides, incident templates, and sector-specific guidance. This skill should be used when the user asks about the "EU AI Act", "AI Act regulation", "Regulation 2024/1689", "KI-Verordnung", asks to "explain an AI Act article", "what does Article X say", "AI Act requirements", "AI Act penalties", "AI Act timeline", "GPAI obligations", "high-risk AI", "prohibited AI practices", "AI Act and GDPR", "fundamental rights impact assessment", "AI Act standards", "AI Act national implementation", "AI literacy", "serious incident reporting", "Digital Omnibus", "AI regulatory sandbox", or any question about EU artificial intelligence regulation. Also triggers on German terms: "KI-Gesetz", "KI-Verordnung", "Hochrisiko-KI", "KI-Kompetenz", "Grundrechte-Folgenabschaetzung", "GPAI-Verhaltenskodex". For assessment workflows that produce a classification decision rather than a knowledge answer, offer to run a structured risk-tier classification in-session.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

lawve-ai/awesome-legal-skills8952026년 10월 20일 업데이트

ai-audit-trail-larissa-meredith-flister

무료

This skill builds a structured audit trail of an AI-assisted task: what the tool was asked to do, what materials it was given, what it produced, how the output was verified, and what was ultimately relied upon. It documents the workflow for supervision and later review without ruling on privilege or disclosure, so the record stays accurate rather than self-serving.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

lawve-ai/awesome-legal-skills8952026년 10월 20일 업데이트

ai-governance-reviewer-carl-ditzler

무료

Use this skill when the user wants an AI governance, legal-risk, privacy, compliance, procurement, or vendor-risk review of an internal AI use case, an AI product feature, an LLM workflow, or a third-party AI vendor. The skill asks intake and clarifying questions first when facts or evidence are missing, identifies required documentation and missing evidence, maps the use case to AI governance frameworks and applicable legal domains, and produces a preliminary or final governance review with scorecards, findings, owners, remediation actions, and follow-up questions.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

lawve-ai/awesome-legal-skills8952026년 10월 20일 업데이트

ambiguity-report

무료

Turn an interpretive-ambiguity audit of a legal text — contract, statute, regulation, or judicial opinion — into a polished deliverable. Produces a multi-page website (default), a single-page interactive site, a Microsoft Word document, a PowerPoint deck, or a LaTeX/PDF. Use whenever a user has a stress-test result, ambiguity audit, or "where will this be litigated" scenarios and wants to publish, present, or share them. Triggers on "publish the audit," "make a report from this," "turn this into a website / deck / brief / Word doc," "make a Netlify site," "build slides of these ambiguities," "render the scenarios," "package this stress test," "produce a LaTeX version," and similar. Pairs with the ambiguity-stress-test skill (the underlying analysis) but works on any structured or semi-structured ambiguity analysis. Visual design is opinionated but the user can override colors, fonts, and brand label. Most formats need Python and a writable filesystem; single-file HTML works where the host has neither.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

lawve-ai/awesome-legal-skills8952026년 10월 20일 업데이트

lawve-ai의 스킬 모두 보기

이 스킬의 문제 신고