internal-investigation

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • Data Ingestion Surface: The skill processes user-supplied information, such as interview notes and document batches, to update internal investigation logs. This is a standard pattern for data-analysis skills.
  • Ingestion points: The skill ingests document batches and interview notes in Mode 2: Add data (SKILL.md).
  • Capability inventory: The skill is capable of performing file-write operations to log.yaml and memo.md and reads configuration from CLAUDE.md.
  • Boundary markers: While not using explicit delimiters for input data, the skill implements structured pull criteria and requires attorney confirmation for checklist updates.
  • Sanitization: The skill utilizes structured YAML formatting for logging surfaced data, which provides separation between user data and internal instructions.
  • File System Operations: The skill manages records within a designated local directory (~/.claude/plugins/config/claude-for-legal/employment-legal/) to maintain investigation logs.
  • Context: This activity is consistent with the skill's intended use case for managing sensitive legal information locally. The skill includes prominent warnings regarding legal privilege and confidentiality to ensure the user is aware of distribution risks.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 07:01 PM