The Agent Skills Directory

External Data Processing: The skill performs web searches to find model policies and guidance (e.g., ABA, NIST, or regulatory acts). This introduces a surface for indirect prompt injection where malicious instructions could be embedded in the retrieved web content. However, the skill mitigates this by requiring the agent to draft sections with [review] flags and providing a 'Sources' block for transparency.
Local File Operations: The skill reads from and writes to specific paths under ~/.claude/plugins/config/claude-for-legal/. This is used to maintain a practice profile and matter-specific context. These operations are restricted to the skill's own functional directory and are used to provide personalized drafting based on the user's previously defined profile.
Review and Adoption Framework: The skill explicitly instructs the agent not to finalize or publish policies autonomously. It enforces a 'draft-only' status through headers and checklists, ensuring that all output remains subject to professional legal review before any use.

policy-starter