The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests content from external files and user-provided details to populate case documents and logs without defined sanitization or boundary markers. This creates a vulnerability surface where malicious instructions embedded in a case description or configuration file could be interpreted as agent commands.
Ingestion points: The skill reads ~/.claude/plugins/config/claude-for-legal-zh/litigation-legal/CLAUDE.md and _log.yaml, and accepts untrusted user input for case details like "Identity Information" and "Initial Theory."
Boundary markers: The instructions do not specify the use of delimiters (e.g., XML tags or block markers) to separate ingested data from agent instructions during processing.
Capability inventory: The skill possesses the capability to write and append to multiple files in the ~/.claude/plugins/config/ directory, including matter.md, history.md, and _log.yaml.
Sanitization: There are no instructions for the agent to sanitize, escape, or validate the content extracted from external sources or user input before interpolating it into the target files.

matter-intake