policy-redraft
Pass
Audited by Gen Agent Trust Hub on May 15, 2026
Risk Level: SAFEDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill instructions specify reading from a configuration file located in a hidden user directory:
~/.claude/plugins/config/claude-for-legal/regulatory-legal/CLAUDE.md. While this appears to be the skill's own configuration path, accessing hidden directories can expose environment-specific settings or internal metadata. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its core function of processing untrusted external data.
- Ingestion points: Regulatory text provided by the user or external sources, current policy text (pasted or read from files), and gap descriptions (as specified in Step 1).
- Boundary markers: The skill employs markers such as
[需核实](Needs Verification) and[用户提供](User Provided) in the output, but lacks strict delimiters (like XML tags or clear separators) to isolate external data from instructions during the model's processing phase. - Capability inventory: The skill has permissions to read local files, write new markdown files to the workspace, and access plugin-specific configuration files as detailed in Step 1 and Step 4.
- Sanitization: No explicit sanitization, filtering, or escaping of the ingested text is performed before it is processed by the model to generate the policy redraft.
Audit Metadata