Is skills/brief safe?
https://github.com/anthropics/knowledge-work-plugins/tree/main/legal/skills/brief
The skills/brief skill is a well-structured legal team briefing tool consisting entirely of a pure-markdown SKILL.md with no executable code, no exfiltration mechanisms, and no prompt injection patterns. All anomalous filesystem events (canary file reads) are attributable to the audit infrastructure's pre- and post-install baseline scans, not to the skill, and canary integrity is confirmed intact. The only notable risk is inherent to the skill's purpose: it aggregates broad, sensitive organizational data (email, contracts, litigation context) which users should ensure is only accessible to trusted agents with appropriate connector permissions.
Category Scores
Findings (4)
LOW Relative link to CONNECTORS.md may trigger agent file read -5 ▶
The SKILL.md contains a markdown link 'CONNECTORS.md' which, if rendered as an agent instruction rather than user-facing documentation, could cause the agent to attempt to read a file two directories above the skill directory. The phrasing ('If you see unfamiliar placeholders...') frames it as guidance for the user, not the agent, so the practical risk is very low.
LOW Broad organizational data access by design -5 ▶
The skill is explicitly designed to scan email, calendar, chat, CLM, and CRM — aggregating legally privileged communications, active litigation context, contract terms, and regulatory exposure into a single brief. This is the intended behavior, but users should be aware that a compromised connector or poisoned source could leak strategic information through the brief output.
INFO GitHub connection expected for install -3 ▶
The only external network connection observed was a TLS connection to 140.82.121.4:443 (github.com), made by the audit pipeline's git clone. No connections were initiated by the skill content itself. Connection diff shows no new persistent listeners after install.
INFO High-value data aggregation creates attractive lateral pivot target -12 ▶
Legal briefings synthesizing contract terms, regulatory inquiries, litigation threats, and insurance coverage create a concentrated intelligence asset. If future skill chaining or connector compromise allowed exfiltration, a single brief invocation could expose significant privileged information. This is an architectural concern for the broader plugin ecosystem, not a defect in this skill.