The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through the ingestion of untrusted legal artifacts.
Ingestion points: The skill reads Equity Purchase Agreements (SPA), contract lists, and status updates uploaded by users, as well as files from "connected repositories" (cloud documents, Feishu, etc.).
Boundary markers: There are no specific instructions or delimiters used to isolate these inputs or warn the agent to ignore instructions embedded within them.
Capability inventory: The skill possesses the ability to read and write files within the ~/.claude/ configuration directory and generate external reports.
Sanitization: There is no evidence of sanitization or validation of the natural language content extracted from documents before it is processed or stored.
[DATA_EXFILTRATION]: The skill constructs file paths dynamically using a user-provided --deal [code] parameter (e.g., ~/.claude/plugins/config/claude-for-legal/corporate-legal/deals/[code]/integration-tracker.yaml). Without explicit validation of the [code] variable, an attacker could provide a path traversal string (like ../../) to read or overwrite unintended files in the local environment. Furthermore, the --export functionality creates a data egress point where potentially malicious data injected via documents could be exported to CSV or Markdown formats.
[EXTERNAL_DOWNLOADS]: In "Mode 2: Contract Assignment," the skill is instructed to search for and "pull" files from external "connected repositories," including cloud document platforms and services like Feishu. This mechanism allows the agent to ingest content from external, remote sources that are not pre-verified or whitelisted.

integration-management