portfolio
Pass
Audited by Gen Agent Trust Hub on Jun 12, 2026
Risk Level: SAFE
Full Analysis
- Structured Data Ingestion: The skill processes external data, such as spreadsheets or dockets, to populate its portfolio register. While this introduces a potential surface for indirect prompt injection if malicious instructions were embedded in asset descriptions, the skill mitigates this by using a structured YAML format for the register and requiring explicit user confirmation before recording consequential actions.
- Human-in-the-Loop Safeguards: A 'consequential-action gate' is implemented for non-legal users, requiring them to verify information with a licensed professional before marking filings as complete. This reduces the risk of automated systems making critical errors or proceeding based on potentially inaccurate input.
- Scoped File Access: The skill reads and writes to a specific configuration directory (~/.claude/plugins/config/claude-for-legal/ip-legal/). This is a legitimate use of local storage for maintaining its state and register, and does not involve accessing sensitive system directories or user credentials.
Audit Metadata