matter-close

Pass

Audited by Gen Agent Trust Hub on May 15, 2026

Risk Level: SAFEPROMPT_INJECTION
Full Analysis
  • [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface (Category 8) by ingesting untrusted data from existing legal matter files to drive workflow logic.
  • Ingestion points: The skill reads matter details from ~/.claude/plugins/config/claude-for-legal/litigation-legal/matters/_log.yaml and [slug]/matter.md.
  • Boundary markers: No explicit delimiters (such as XML tags or triple backticks with 'ignore' warnings) are used to isolate ingested content from the system prompt.
  • Capability inventory: The skill is authorized to perform file-write and file-append operations across several markdown and YAML files.
  • Sanitization: The skill does not perform input validation or escaping on the ingested file content or user-provided 'Reflections' before persisting them to disk.
Audit Metadata
Risk Level
SAFE
Analyzed
May 15, 2026, 07:07 AM
Security Audit — agent-trust-hub — matter-close