Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/modu-ai/moai-coworkWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/plugins/modu-ai/moai-cowork/moai-lawyer)<a href="https://agentmods.dev/plugins/modu-ai/moai-cowork/moai-lawyer"><img src="https://agentmods.dev/badge/plugins/modu-ai/moai-cowork/moai-lawyer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/plugins/modu-ai/moai-cowork/moai-lawyer"><img src="https://agentmods.dev/badge/plugins/modu-ai/moai-cowork/moai-lawyer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>Grade A, and why
moai-lawyer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 14d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
{
"name": "moai-lawyer",
"displayName": "⚖️ 법무 담당",
"version": "1.4.18",
"description": "법무 전담 AI 코워커 — 계약 검토·NDA 트리아지·컴플라이언스 점검·법령/판례 리서치·국내외 특허/상표 선행조사·식약처 안전 기준 스킬. 국가법령정보 MCP(korean-law)로 인용을 검증하고, 특허/상표 공식 데이터 MCP(moai-mcp-ip)로 한국·미국·일본·유럽 DB를 조회합니다. 이런 분께 추천: 1인 사업자·스타트업 운영자. ※ 법률 자문 대체가 아닌 참고 자료입니다.",
"author": {
"name": "모두의 AI",
"email": "[email protected]"
},
"license": "Apache-2.0",
"userConfig": {
"KOREAN_LAW_OC": {
"type": "string",
"title": "법제처 Open API OC 키",
"description": "law.go.kr 에서 무료로 발급받는 사용자별 키입니다.",
"sensitive": true
},
"KIPRIS_API_KEY": {
"type": "string",
"title": "KIPRIS Plus 인증키",
"description": "한국 특허·상표 조회용. KIPRIS Plus 마이페이지 → APIKEY 관리에서 확인합니다. 쓰지 않으면 비워 두세요.",
"sensitive": true
},
"USPTO_ODP_API_KEY": {
"type": "string",
"title": "USPTO Open Data Portal API 키",
"description": "미국 특허 검색용. data.uspto.gov 에서 발급합니다. 쓰지 않으면 비워 두세요.",
"sensitive": true
},
"USPTO_TSDR_API_KEY": {
"type": "string",
"title": "USPTO TSDR API 키",
"description": "미국 상표 사건 상태 조회용. USPTO API Key Manager 에서 발급합니다. 쓰지 않으면 비워 두세요.",
"sensitive": true
},
"JPO_API_USER": {
"type": "string",
"title": "일본 특허청(JPO) API 아이디",
"description": "JPO 特許情報取得API 이용 등록 후 받은 ID. 쓰지 않으면 비워 두세요.",
"sensitive": false
},
"JPO_API_PASSWORD": {
"type": "string",
"title": "일본 특허청(JPO) API 비밀번호",
"description": "JPO 가 발급한 비밀번호. 쓰지 않으면 비워 두세요.",
"sensitive": true
},
"EPO_OPS_KEY": {
"type": "string",
"title": "EPO OPS consumer key",
"description": "유럽·국제 특허 조회용. developers.epo.org 앱에서 발급합니다. 쓰지 않으면 비워 두세요.",
"sensitive": true
},
"EPO_OPS_SECRET": {
"type": "string",
"title": "EPO OPS consumer secret",
"description": "EPO OPS 앱의 secret. 쓰지 않으면 비워 두세요.",
"sensitive": true
}
}
}
What it installs
The manifest is a name and a version. 13 skills, 2 agents travel with it, and installing the plugin installs all of them — 1,155 tokens a session between them. Each is measured on its own page, and each can be installed alone.
- Skill legal-ip-search-report A 269 tokens
- Skill legal-compliance-check A 49 tokens
- Skill legal-contract-review A 53 tokens
- Skill legal-law-research A 44 tokens
- Skill legal-patent-analyzer A 73 tokens
- Skill legal-iros-registry-automation A 52 tokens
- Skill legal-legal-risk A 50 tokens
- Skill legal-mfds-safety A 47 tokens
- Skill legal-patent-search A 66 tokens
- Skill legal-service-launch-checklist A 64 tokens
- Skill legal-evidence-audit A 63 tokens
- Skill legal-nda-triage A 53 tokens
- Skill legal-workflow A 64 tokens
- Agent legal-researcher A 89 tokens
- Agent risk-auditor A 119 tokens
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 14d ago Changed aadf815adaad
- 17d ago Changed 4d1392044871
- 28d ago Changed · +42 lines b19dcfeb8cba
- 1mo ago First seen · 20 lines scan A 23d59f6dbcf9
moai-lawyer is a plugin published in the GitHub repository modu-ai/moai-cowork (311 stars, last pushed 15d ago), licensed Apache-2.0. Its token cost is not measured: this kind of file is read by the harness, not the model. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other plugins, from other repositories
penalista-italia
Kit operativo per avvocati penalisti italiani: strategia difensiva, redazione atti, calcolo termini e prescrizione, misure cautelari, ricerca giurisprudenziale, esecuzione penale. 9 skill specializzate sul processo penale italiano. Di Synthos Logic.
fakoli-speak
Multi-provider text-to-speech with owned playback, opt-in autospeak, and local cost estimates.
ga-court-docs
Draft and format pleadings, declarations, motions, notices, and proposed orders for Georgia courts. Applies O.C.G.A. § 9-11-10 + Uniform Superior Court Rules statewide formatting; includes Fulton County Superior Court and Cobb County Superior Court specifics plus a county-courts roll-up; supports pro se workflows.…
humanizer
Rewrite AI-sounding text so it reads like the writer without changing what it says.
claude-plugins-official marketplace
Directory of popular Claude Code extensions including development tools, productivity plugins, and MCP integrations.
nextjs
Official Next.js skills: adopt and optimize Cache Components, adopt Partial Prefetching, and verify runtime behavior against a running dev server.