gap-surfacer
Pass
Audited by Gen Agent Trust Hub on Jul 3, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from other modules (e.g., policy-diff) to populate its tracking database, which creates a potential surface for indirect instruction embedding. This risk is effectively mitigated by the skill's design.
- Ingestion points: Data is ingested from the policy-diff skill and stored in
~/.claude/plugins/config/claude-for-legal/regulatory-legal/gap-tracker.yaml. - Boundary markers: The skill uses structured YAML for data storage, providing clear separation between different data fields.
- Capability inventory: The skill can read/write local configuration files and send messages via a Slack tool (MCP).
- Sanitization: The skill contains a prominent 'Verify citations' warning block that explicitly instructs users to check primary sources, acknowledging the risk of AI fabrication or stale information.
- [DATA_EXFILTRATION]: While the skill communicates externally via Slack, it implements a highly restrictive 'Per-send confirmation' policy.
- Evidence: The instructions require the agent to show a preview of every message and wait for an 'explicit yes' from the user before sending, preventing automated or unauthorized data transmission.
Audit Metadata