policy-starter
Pass
Audited by Gen Agent Trust Hub on May 15, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE]: The skill reads from
~/.claude/plugins/config/claude-for-legal/ai-governance-legal/CLAUDE.mdto retrieve regulatory data and AI system lists. This is an intended use of a local configuration file specific to the skill's purpose (legal governance) and does not involve accessing sensitive OS credentials or private keys. - [COMMAND_EXECUTION]: The skill does not contain any shell commands, subprocess calls, or scripts that execute code on the host machine. It operates purely as a template-based text generation workflow.
- [EXTERNAL_DOWNLOADS]: No external network requests, remote script downloads, or package manager operations (npm, pip) were detected.
- [PROMPT_INJECTION]: The skill uses direct instructional language to guide the agent through a drafting process. It does not contain bypass markers, override instructions, or attempts to extract system prompts.
- [DATA_EXFILTRATION]: No network operations (
curl,wget,fetch) are present. Data read from the local configuration is used solely to generate a response draft for the user within the agent session.
Audit Metadata