The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data, specifically pasted emails or messages from individuals exercising data rights. This creates a vulnerability surface where a malicious request could attempt to influence the agent's logic or data handling processes.
Ingestion points: Untrusted data enters the context via the [粘贴请求邮件] placeholder and the argument-hint instruction.
Boundary markers: The skill does not define specific technical delimiters (like XML tags or unique markers) to isolate user-provided text from the system instructions.
Capability inventory: The skill has capabilities to read and write files within the ~/.claude/plugins/config/claude-for-legal-zh/privacy-legal/ directory structure.
Sanitization: While it lacks technical sanitization, it implements logical safeguards such as "Prohibit silent supplementation," mandatory retrieval of legal rules, and a requirement for lawyer review before any output is used.
[DATA_EXFILTRATION]: The skill is explicitly designed to handle Personally Identifiable Information (PII) and internal system metadata.
Sensitive file paths: It accesses and writes to configuration and matter-specific files in ~/.claude/plugins/config/claude-for-legal-zh/privacy-legal/. While these are local paths, they contain sensitive legal context and potentially harvested data.
Mitigation: The instructions include best practices for the user, such as deleting unnecessary ID attachments and avoiding the use of subject names in filenames, which helps reduce the risk of accidental exposure.

dsar-response