expansion-kickoff
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- Data Processing Surface: The skill generates expansion trackers by combining user-provided country names with data from a jurisdictional configuration file. This creates a surface where external inputs are processed and written to the file system. * Ingestion points: The skill reads from
~/.claude/plugins/config/claude-for-legal/employment-legal/CLAUDE.mdand accepts a[country name]argument. * Boundary markers: There are no explicit delimiters or instructions provided to the agent to treat the embedded jurisdictional data as untrusted. * Capability inventory: The skill utilizes file reading and writing capabilities within the~/.claude/plugins/config/directory. * Sanitization: The instructions do not specify validation or escaping for the country name input or the jurisdictional footprint data before they are used to create or update tracker files.
Audit Metadata