launch-review
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources including Product Requirement Documents (PRDs), Feishu/Lark document links, and tracking ticket IDs. Maliciously crafted instructions within these documents could attempt to influence the legal review process or bypass guidelines.\n
- Ingestion points: PRD files, external documentation links (Feishu), and online tracking tickets (SKILL.md).\n
- Boundary markers: The instructions do not define specific delimiters or instructions for the agent to ignore embedded commands within the processed documents.\n
- Capability inventory: The skill reads from and writes to local plugin directories and interacts with external enterprise tools (Feishu, DingTalk, Teambition) via Model Context Protocol (MCP) integrations.\n
- Sanitization: No explicit sanitization or input validation logic is present for the ingested text.\n- [DATA_EXFILTRATION]: The skill accesses local configuration files and matter-specific context stored in
~/.claude/plugins/config/claude-for-legal-zh/. These paths are specific to the plugin's infrastructure, following the vendor's naming pattern.\n - Evidence: The skill loads framework and risk calibration data from
~/.claude/plugins/config/claude-for-legal-zh/product-legal/CLAUDE.mdand maintains matter workspaces in subdirectories of the same path (SKILL.md).
Audit Metadata