The Agent Skills Directory

[PROMPT_INJECTION]: Indirect Prompt Injection Surface. The skill is designed to ingest and process Data Processing Agreements (DPA) provided by external parties (clients or vendors). These untrusted documents could contain instructions aimed at subverting the review process or extracting information from the local configuration files.
Ingestion points: Untrusted DPA content provided via file uploads, links, or pasted text (referenced in the argument-hint and Step 2 of the workflow).
Boundary markers: The skill lacks explicit delimiters or specific 'ignore embedded instructions' warnings for the processing of the DPA text.
Capability inventory: The skill has read/write access to ~/.claude/plugins/config/claude-for-legal/ (Step 1, Step 5) and can perform web searches.
Sanitization: There is no evidence of sanitization or filtering of the DPA content before it is processed by the model.
[DATA_EXFILTRATION]: Potential Data Exposure via Web Search. The skill instructions allow the agent to perform web searches ('联网检索') if internal data retrieval is insufficient. There is a risk that sensitive clauses from a private DPA could be included in search queries, exposing them to search engines. This is partially mitigated by a requirement for the user (lawyer) to manually approve the search.
[COMMAND_EXECUTION]: File System Operations. The skill performs file reads and writes within the ~/.claude/plugins/config/claude-for-legal/ directory. While these are restricted to the plugin's internal configuration and work-product folders, the paths are dynamically generated using matter slugs, which could be a target for path manipulation if the slugs are not properly validated.

dpa-review