The Agent Skills Directory

Indirect Prompt Injection Surface: The skill is designed to extract rules, positions, and preferences from user-provided documents (such as signed agreements and escalation matrices) and write them into a central configuration file (CLAUDE.md). Because this configuration acts as the authoritative instruction set for other automated tools within the plugin, there is a possibility that instructions embedded within an uploaded document could influence future AI outputs. This surface is inherent to the skill's primary function as a configuration tool.
Ingestion points: The skill ingests interview responses, seed documents (signed agreements), and shared company profile data as seen in the 'Instructions' and 'Part 4: Seed documents' sections of SKILL.md.
Boundary markers: The skill includes a verification step where it displays a summary of the extracted information and asks the user for confirmation ('What did I get wrong?') before writing the final configuration, as described in Step 7 of the Instructions.
Capability inventory: The skill has the capability to write a practice profile to the user's home directory (~/.claude/plugins/config/.../CLAUDE.md). This file is then read by multiple other tools in the plugin (e.g., /review, /renewal-tracker, /amendment-history) to define their operational logic and playbook positions.
Sanitization: While the skill provides a manual review checkpoint for the user, it does not mention explicit automated sanitization of the extracted document content to prevent the inclusion of hidden or adversarial instructions.
Sensitive Data Handling: The skill requests access to sensitive documents such as signed legal agreements and internal escalation matrices. While this is necessary for the intended purpose of calibrating the legal plugin to a specific practice, it involves the processing of high-value organizational data.
Integration Connectivity Probing: The skill includes functionality to verify the status of external integrations (MCPs) for storage, e-signature, and communication platforms (e.g., Google Drive, Slack, DocuSign). These are standard service integrations used to provide automated workflows, and the skill performs connectivity tests to ensure they are functioning correctly.

cold-start-interview