The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes regulatory data sourced from external feeds, which could contain malicious instructions designed to influence the agent's behavior during report generation or notification.
Ingestion points: Reads from ~/.claude/plugins/config/claude-for-legal-zh/regulatory-legal/gap-tracker.yaml and references/comment-tracker.yaml.
Boundary markers: None present in the instructions or data schema to separate external content from agent instructions.
Capability inventory: The skill has file system write access to its configuration directory and network access via enterprise communication tool integrations (referenced as Slack).
Sanitization: No programmatic sanitization or escaping is applied to the ingested data prior to its inclusion in prompts or notifications; the skill relies on a mandatory 'human-in-the-loop' confirmation step as its primary safety control.
[DATA_EXFILTRATION]: The skill transmits internal policy gap information and regulatory summaries to external platforms (e.g., Slack). Although this is the intended purpose, the use of external enterprise communication tools constitutes a data exfiltration vector if triggered with sensitive information or directed to unauthorized endpoints.

gap-surfacer