The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data in its 'receive mode' without explicit sanitization or boundary markers.
Ingestion points: The SKILL.md file (Instruction 3 and Step 1 of Receive Mode) accepts an incoming letter via file path or pasted text to perform triage.
Boundary markers: The instructions do not define any specific delimiters or 'ignore' commands to isolate the untrusted incoming letter from the agent's core instructions.
Capability inventory: The skill has the ability to write files to the local file system (using the docx skill for letters and writing triage.md and checklist.md files) and perform automated triage analysis.
Sanitization: There are no documented steps for escaping or validating the content of the incoming letter before it is used to generate the options memo.
[DATA_EXFILTRATION]: The skill accesses local configuration files containing sensitive legal posture information, though no exfiltration behavior was detected.
Evidence: The skill is instructed to read ~/.claude/plugins/config/claude-for-legal/ip-legal/CLAUDE.md and matter.md which contain the 'Enforcement posture', 'Approval matrix', and 'IP practice profile'. This is considered safe as it is the intended functionality for a local legal assistant, but it represents a high-value target for other malicious skills.

cease-desist