The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill instructions in SKILL.md direct the agent to ask the user for their Wolters Kluwer API_KEY and API_SECRET and then execute Python code to write these credentials into a config.json file in the skill's local directory. Storing sensitive credentials in a plaintext JSON file within the application workspace is a risky practice for secret management compared to using environment variables or dedicated secret stores.
[DYNAMIC_EXECUTION]: The skill employs dynamic module loading and runtime path manipulation which can be used to hide malicious behavior or bypass static security analysis.
The file use_database_by_api/db_adapter.py dynamically modifies sys.path to load the wolterskluwer_searcher module.
The test file tests/test_mcp.py uses importlib.import_module to dynamically load the mcp_server module.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-provided facts and legal narratives to generate research reports, creating an attack surface where malicious instructions could be embedded in user data.
Ingestion points: Legal case descriptions and user identity information gathered during the mandatory workflow steps in SKILL.md.
Boundary markers: The skill lacks explicit delimiters or instructions for the agent to ignore potentially malicious commands embedded in the user's legal facts.
Capability inventory: The skill has the capability to write local files (config.json, Markdown/Word reports) and perform network requests through its database API wrappers.
Sanitization: No evidence of sanitization or escaping is provided for user-provided data before it is interpolated into internal prompts or research queries.

legal-issue-research