integration-management
Pass
Audited by Gen Agent Trust Hub on Jul 3, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns or behaviors were detected. The skill implements security best practices.
- [PROMPT_INJECTION]: The skill processes untrusted data from multiple external sources to generate trackers and reports, which constitutes a surface for indirect prompt injection.
- Ingestion points: Reads data from uploaded documents (Purchase Agreements, deal summaries, status updates), CSV/Excel contract lists, and documents from connected cloud repositories (Google Drive, Box, SharePoint).
- Boundary markers: The skill does not provide explicit boundary markers or instructions to ignore commands embedded within processed legal documents.
- Capability inventory: The skill manages integration data via file system read/write operations within a scoped directory (~/.claude/plugins/config/claude-for-legal/).
- Sanitization: The skill proactively implements a 'Formula injection defense' for its CSV and table exports, neutralizing potential spreadsheet-based attacks (DDE/formula execution) sourced from external data.
Audit Metadata