The Agent Skills Directory

Indirect Prompt Injection Surface: The skill is designed to automatically ingest and reconcile data from various external and upstream sources, which could potentially contain untrusted instructions.
Ingestion points: Data is gathered from Mode 2 (upstream outputs like diligence-issue-extraction, material-contract-schedule, and deal-team-summary), Mode 1 (external web research for regulatory mechanics), and the dataroom-watcher agent (which pulls updates from email and Slack).
Boundary markers: The instructions do not specify the use of clear delimiters or "ignore embedded instructions" warnings when processing these diverse inputs into the YAML checklist.
Capability inventory: The skill performs file read and write operations on closing-checklist.yaml within the ~/.claude/plugins/config/ directory based on the ingested data.
Sanitization: There are no explicit instructions for sanitizing, validating, or filtering the content retrieved from external communications (email/Slack) or diligence findings before they are appended to the checklist.
Specific File Path Usage: The skill operates within specific directories under ~/.claude/plugins/config/claude-for-legal/. While these are targeted paths necessary for the skill's stated purpose of managing legal deal records, the access pattern should be noted as part of the operational scope.
Professional Safety Guardrails: The skill incorporates a safety gate ("Consequential-action gate") that prompts for attorney review before producing final legal certifications. This represents a positive practice by adding a human-in-the-loop checkpoint for high-consequence actions.

closing-checklist