internal-investigation
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- Data Ingestion Surface: The skill processes user-supplied information, such as interview notes and document batches, to update internal investigation logs. This is a standard pattern for data-analysis skills.
- Ingestion points: The skill ingests document batches and interview notes in
Mode 2: Add data(SKILL.md). - Capability inventory: The skill is capable of performing file-write operations to
log.yamlandmemo.mdand reads configuration fromCLAUDE.md. - Boundary markers: While not using explicit delimiters for input data, the skill implements structured pull criteria and requires attorney confirmation for checklist updates.
- Sanitization: The skill utilizes structured YAML formatting for logging surfaced data, which provides separation between user data and internal instructions.
- File System Operations: The skill manages records within a designated local directory (
~/.claude/plugins/config/claude-for-legal/employment-legal/) to maintain investigation logs. - Context: This activity is consistent with the skill's intended use case for managing sensitive legal information locally. The skill includes prominent warnings regarding legal privilege and confidentiality to ensure the user is aware of distribution risks.
Audit Metadata