Is skills/legal-response safe?
https://github.com/anthropics/knowledge-work-plugins/tree/main/legal/skills/legal-response
The legal-response skill is a well-structured pure-markdown workflow guide for generating templated legal responses with comprehensive escalation triggers and explicit counsel-review requirements. It contains no executable code, git hooks, submodules, or covert network instructions, and canary files were accessed only by the audit infrastructure itself. The two identified low-severity issues — a cross-directory CONNECTORS.md relative link and a transparent email MCP integration note — do not represent meaningful attack surfaces given the skill's read-only, user-gated operation model.
Category Scores
Findings (4)
LOW Cross-directory relative link to CONNECTORS.md -12 ▶
The blockquote note at the top of SKILL.md references ../../CONNECTORS.md — two directory levels above the skill root. An agent that eagerly resolves Markdown links at skill-load time would attempt to read a file outside the skill's own directory. In the Anthropics plugin monorepo this is legitimate shared documentation, but the out-of-scope file reference is an injection surface if the skill were rehosted in a different directory layout or the CONNECTORS.md file were replaced with adversarial content.
LOW Email MCP integration routes legal content to external tooling -8 ▶
The skill's Notes section instructs agents to offer email draft creation via MCP when an email connector is active. Legal responses may contain PII (requester identity, contact information), special-category data (health, biometric references in DSR workflows), and matter-sensitive details (litigation hold scope, subpoena references). Routing this content to email tooling without an additional in-skill confidentiality checkpoint is a low-severity but non-trivial trust boundary crossing.
INFO Expected sparse clone from github.com; no persistent state changes -8 ▶
The installation connected only to GitHub (140.82.121.3:443) and local DNS (10.0.2.3:53). No new listening ports were opened, no background processes were left running, and the connection diff shows no persistent state changes attributable to the skill. The clone used --depth 1 and --no-checkout with sparse-checkout, minimising attack surface from the broader monorepo.
INFO Canary file reads are audit-infrastructure artefacts; no exfiltration 0 ▶
Six credential-equivalent canary files were accessed (OPEN/ACCESS/CLOSE_NOWRITE) in two batches — one before the git clone and one after all scanning completed. Cross-referencing auditd process ancestry and execution timestamps confirms both batches originate from the oathe-audit.sh platform's own setup/teardown routines, not from any code introduced by the skill. The platform's integrity check confirms no file content was modified or exfiltrated.