reg-gap-analysis
Pass
Audited by Gen Agent Trust Hub on May 13, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- Sensitive Internal Data Access: The skill reads from
~/.claude/plugins/config/claude-for-legal/privacy-legal/CLAUDE.md, which contains regulatory footprints and operational practices. Accessing plugin-specific configuration files is an internal data operation. - Indirect Prompt Injection Surface: The skill ingests regulatory text that could potentially contain instructions intended to influence agent behavior.
- Ingestion points: Regulatory text pasted by users or fetched via external connectors in
SKILL.md. - Boundary markers: No explicit delimiters or instructions to ignore embedded commands were found.
- Capability inventory: Reading sensitive internal documents and accessing research tools.
- Sanitization: No explicit filtering or sanitization of external text is performed.
Audit Metadata