legal-qa-extractor
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted legal consultation records from the local file system, creating an attack surface where embedded instructions in the source text could attempt to influence the agent's extraction logic.\n
- Ingestion points: The skill reads
.mdand.txtfiles from user-defined paths specified inconfig/.env(e.g.,~/Documents/legal-consultations).\n - Boundary markers: The agent is directed to follow logical checklists in
references/intake-checklist.mdandreferences/extraction-rules.md, but no technical delimiters are implemented to isolate source text from the processing instructions.\n - Capability inventory: The skill performs directory traversal, file reading, SHA-256 content hashing, and writes structured markdown reports and JSON logs to the local file system.\n
- Sanitization: The skill enforces strict desensitization rules in
references/output-template.mdto mask PII (names, enterprises, addresses) in the output, but does not provide technical sanitization of the source input to prevent instruction injection.\n- [COMMAND_EXECUTION]: TheSKILL.mdfile includes instructions directing the agent to perform basic shell commands, specificallycp config/.env.example config/.env, as part of the initial configuration and environment setup process.
Audit Metadata