diligence-issue-extraction
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- Path Traversal Surface: The skill instructions guide the agent to construct file paths using user-provided identifiers such as
[code]and<matter-slug>(e.g.,~/.claude/plugins/config/claude-for-legal/corporate-legal/deals/[code]/deal-context.md). If these inputs are not strictly validated, an attacker could potentially use directory traversal sequences (like../) to read or write files outside the intended directories. - Access to Internal Configuration Directory: The skill reads from and writes to
~/.claude/plugins/config/, which appears to be the configuration directory for the agent's plugin ecosystem. Accessing such internal paths poses a security consideration as these files may contain sensitive operational metadata or configuration settings. - Indirect Prompt Injection Surface: As a core functionality, the skill processes large numbers of external documents from Virtual Data Rooms (VDRs). These documents are untrusted sources that could contain embedded instructions intended to manipulate the agent's extraction logic, severity assessments, or recommendations.
- Ingestion points: Documents read from VDR MCP tools (Box, Intralinks, Datasite) as described in
SKILL.md. - Boundary markers: The skill does not currently specify the use of clear delimiters or instructions to ignore embedded prompts within the VDR content.
- Capability inventory: The skill possesses file read/write capabilities within specified paths and can invoke various MCP tools for legal research and data room access.
- Sanitization: The instructions do not explicitly detail a process for sanitizing or escaping the content retrieved from VDR documents before it is processed by the model.
Audit Metadata