use-case-triage
Pass
Audited by Gen Agent Trust Hub on May 15, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill performs localized file operations limited to the plugin's configuration and matter directories (~/.claude/plugins/config/claude-for-legal/privacy-legal/). These actions are consistent with its stated purpose of privacy legal triage.
- [SAFE]: No network operations, hardcoded credentials, or external data transmission patterns were identified.
- [SAFE]: The skill does not use obfuscation, dynamic code generation, or privilege escalation techniques.
- [PROMPT_INJECTION]: The skill has an indirect prompt injection surface due to processing untrusted data.
- Ingestion points: User-provided descriptions of 'personal information processing activities' and potentially shared local configuration files (CLAUDE.md, matter.md).
- Boundary markers: Absent. The instructions do not specify delimiters or warnings to ignore instructions embedded within the processed activity descriptions.
- Capability inventory: Reading and writing specific local files within the claude-for-legal plugin directory.
- Sanitization: Absent. There is no explicit logic to sanitize or escape external content before it is processed by the agent.
Audit Metadata