The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection (Category 8) because it ingests untrusted student text and case hypotheses for analysis without using explicit boundary markers or delimiters.
Ingestion points: Student papers and case hypotheses provided via the argument-hint or direct pasting into the session (SKILL.md).
Boundary markers: Absent; the instructions for the agent to "carefully read" the student's answer do not provide delimiters to separate student content from skill instructions.
Capability inventory: The skill has the capability to write to the local filesystem using the tracker.md file (SKILL.md).
Sanitization: The skill lacks explicit instructions to sanitize ingested text or to ignore embedded commands that might attempt to override the grading logic.
[DATA_EXFILTRATION]: The skill manages student progress by reading from and appending to local files located in the ~/.claude/plugins/config/claude-for-legal/ directory. These operations are functional for the skill's purpose as a persistent learning tool and are limited to the vendor's specific plugin environment.
The skill reads student context (learning style, curriculum) from CLAUDE.md to personalize feedback.
The skill appends session summaries and performance patterns to a local tracker.md file to provide long-term feedback.

irac-practice