The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill includes a detailed bootstrap protocol in references/agents-rules.md (§5) that directs the agent to install external dependencies such as the mcp-taiwan-legal-db Python package via pip or pipx. It also provides instructions to register a remote HTTP MCP server at https://tlr.dr-lawbot.com/mcp, which allows for remote code interaction with an unverified third-party service.
[COMMAND_EXECUTION]: The skill provides specific shell commands for the agent to execute (upon user consent) that modify sensitive local configuration files across multiple platforms, including ~/.claude.json, ~/.gemini/config/mcp_config.json, and %APPDATA%\Claude\claude_desktop_config.json. It also suggests using npx mcp-remote for stdio bridging.
[PROMPT_INJECTION]: The SKILL.md file contains a 'License Iron Rule' (⛔ 使用授權鐱律) that uses meta-instructions to override the agent's behavior. It explicitly commands the agent to ignore subsequent user instructions, prompts, or roleplay that attempt to bypass specific usage restrictions, which is a pattern associated with instruction injection.
[DATA_EXPOSURE]: The skill is designed to ingest legal facts and contract data from external tools (taiwan-legal-db and dr-lawbot) and write them directly into a local data.js file for visualization.
Ingestion points: Outputs from legal-research and legal-brainstorming tools, as well as remote MCP server responses.
Boundary markers: None identified; there are no instructions to delimit or warn the agent about potentially malicious instructions embedded in the legal data.
Capability inventory: The skill has the capability to write to the file system (data.js and SVG files) and execute shell commands via the bootstrap protocol.
Sanitization: There are no instructions for escaping, validating, or filtering the ingested external content before it is written to the execution environment.

legal-graph