skill-manager
Pass
Audited by Gen Agent Trust Hub on Jul 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill is authorized to perform file system modifications, including the removal of plugin directories and the renaming of operational files (e.g.,
SKILL.mdtoSKILL.md.disabled). These actions are restricted to community plugins and require explicit user consent via a 'yes' prompt. - [DATA_EXFILTRATION]: The skill accesses local configuration and audit logs within the
~/.claude/plugins/config/claude-for-legal/directory to identify target paths for management. These paths are specific to the skill's infrastructure and the 'legal-builder-hub' ecosystem. - [PROMPT_INJECTION]: While the skill processes external data from an installation log, which presents a surface for indirect prompt injection, it mitigates this risk through a mandatory confirmation workflow, strict path validation, and a hardcoded exclusion list that prevents the modification of first-party or core plugins. Specifically, it follows a multi-step evidence chain for processing untrusted log data:
- Ingestion points: Reads
install-log.yamlto determine targets. - Boundary markers: Uses explicit 'yes/no' user confirmation and compares paths against a protected list of 12 core plugins.
- Capability inventory: Limited to directory deletion and file renaming within the plugin scope.
- Sanitization: Validates that the skill exists in the log and that its path resolves outside of pre-installed system directories.
Audit Metadata