The Agent Skills Directory

[PROMPT_INJECTION]: The skill incorporates safety reminders into its core operational logic, instructing the agent to explicitly warn users that calculated deadlines are for reference only and must be verified with official registries (CNIPA, WIPO, EUIPO). This implementation serves as a guardrail rather than an attempt to bypass safety protocols.- [DATA_EXFILTRATION]: The skill manages an internal registry stored at ~/.claude/plugins/config/claude-for-legal/ip-legal/portfolio.yaml. While the skill reads and writes to this configuration file, no evidence of unauthorized data transmission to external domains was detected. All external references are for user-directed verification.- [COMMAND_EXECUTION]: File system interactions are limited to standard operations required for the skill's primary purpose, such as reading and updating its local registry. There are no patterns of arbitrary command execution or attempts to gain unauthorized shell access.- [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it is designed to ingest data from external sources, including IP management systems and user-provided spreadsheets.
Ingestion points: Data enters the agent context through portfolio.yaml, user-shared export files (Excel/CSV), and integrated third-party IP systems.
Boundary markers: The skill specifies the use of work product headers and specific footer reminders, which help distinguish agent output from processed data.
Capability inventory: Capabilities are limited to local file system management (read/write) within the defined configuration path.
Sanitization: While the skill does not explicitly detail a sanitization process, the risk is mitigated by the highly structured nature of the YAML registry and the requirement for manual user verification of all critical legal data.

portfolio