The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data, specifically legal documents like '阅卷笔录' (case transcripts) and '证据链' (evidence chains), which may contain adversarial instructions.
Ingestion points: Processes files within the criminal-legal/skills workflow.
Boundary markers: The skill mentions a '强制脱敏红线与防幻觉校验纪律' (forced desensitization and anti-hallucination discipline) as a safety measure, though these are natural language instructions rather than technical delimiters.
Capability inventory: The agent is instructed to use tools for local file access, web verification, and document rendering.
Sanitization: The instructions emphasize '脱敏' (desensitization) but lack explicit technical sanitization or schema validation for incoming text.
[DATA_EXPOSURE]: The instructions direct the agent to access and read configuration profiles from the ~/.claude/plugins/config/ directory to maintain compatibility with other tools. While not an exfiltration attempt, this involves cross-application file access to potentially sensitive configuration directories.

chinese-legal-criminal