ai-tool-handoff
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external data rooms and text outputs from third-party tools such as Luminance and Kira. These sources could contain hidden instructions (e.g., in contract text or metadata) designed to manipulate the AI's QA or judgment layer.
- Ingestion points: Legal documents identified in the data room directory and extracted text provided by external AI tools.
- Boundary markers: The skill does not implement specific delimiters or 'ignore embedded instructions' warnings when handling extracted text, increasing the risk that the AI follows instructions contained within the analyzed clauses.
- Capability inventory: The skill reads from and writes to the agent's local configuration and matter directories (~/.claude/plugins/config/claude-for-legal-zh/...).
- Sanitization: There is no evidence of text sanitization or validation of the external content before it is integrated into the decision-making context.
Audit Metadata