demand-received
Pass
Audited by Gen Agent Trust Hub on Jul 3, 2026
Risk Level: SAFEPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external documents provided by the user to extract legal claims and assess merit. It lacks explicit isolation or instructions to ignore embedded commands within these documents.
- Ingestion points: Reads an incoming document from the user-provided
[path-to-incoming](SKILL.md, Step 1). - Boundary markers: No specific delimiters or boundary warnings are used to separate user-provided data from the skill's logic.
- Capability inventory: Accesses internal legal matter logs (
_log.yaml), writes triage reports to the file system, and executes external legal research tools (Westlaw, CourtListener, etc.). - Sanitization: The skill does not perform any sanitization or escaping of the content extracted from the demand letter before using it for analysis.
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill reads from
~/.claude/plugins/config/claude-for-legal/litigation-legal/matters/_log.yaml, which contains the company's litigation portfolio and matter history. While this is necessary for the skill's primary function (cross-checking for existing matters), this confidential data could be exposed to an attacker if the agent is compromised through indirect prompt injection. - [REMOTE_CODE_EXECUTION]: The skill integrates with external legal research platforms (Westlaw, CourtListener, Trellis, Descrybe). These are recognized as well-known technology services and their use is consistent with the skill's intended legal triage purpose.
Audit Metadata