The Agent Skills Directory

[Indirect Prompt Injection Surface]: The skill reads from local files such as matter.md and _log.yaml to generate legal hold notices and portfolio reports. If these files contain data sourced from external parties (e.g., matter descriptions or custodian notes), there is a potential for that data to contain hidden instructions that could influence the agent's behavior.
[Specific Local File Access]: The skill is configured to interact with a specific directory hierarchy (~/.claude/plugins/config/claude-for-legal/) to store and retrieve legal documentation. While this is necessary for the skill's function, it involves the management of sensitive organizational information, and users should ensure appropriate file-level permissions are maintained.

legal-hold