The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill functions as an adapter that dynamically loads and follows instructions from external files (commercial-legal/CLAUDE.md, skills/*/SKILL.md) and configuration profiles. This architectural choice creates a surface where instructions embedded in those external files can influence the agent's behavior.
Ingestion points: The agent is instructed to read commercial-legal/CLAUDE.md, existing user profiles in ~/.claude/plugins/config/, and specific SKILL.md files from the domain's skills directory.
Boundary markers: None identified; there are no instructions to the agent to treat content from these files as untrusted or to use specific delimiters to separate them from the system instructions.
Capability inventory: The skill notes capabilities for local file access, web verification, document rendering, and processing natural language legal requests.
Sanitization: There is no mention of sanitizing or validating the contents of the local files before they are processed as instructions.
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill requires the agent to access and read configuration data from the user's home directory (~/.claude/plugins/config/). While intended to adapt to existing user practices, this pattern involves reading from local configuration paths which could contain user-specific plugin data.

chinese-legal-commercial