Is skills/legal-risk-assessment safe?
https://github.com/anthropics/knowledge-work-plugins/tree/main/legal/skills/legal-risk-assessment
The legal-risk-assessment skill is a clean, well-structured markdown prompt file containing a legal risk framework (severity × likelihood matrix, escalation criteria, documentation templates) with no executable code, no external URL references, no file-access instructions, and no prompt injection patterns. Canary file accesses detected during monitoring are attributable to the audit harness's own pre/post baseline checks, not to the skill, and all canary files remain intact and unmodified. The only notable risk is a theoretical supply-chain substitution scenario where a malicious fork could bias the scoring thresholds, which does not apply to this canonical Anthropics repository version.
Category Scores
Findings (4)
INFO Standard bounded persona establishment -3 ▶
The skill opens with 'You are a legal risk assessment assistant for an in-house legal team.' This is a normal, scoped role assignment that does not override system instructions or attempt to replace the agent's primary identity. The accompanying disclaimer ('You assist with legal workflows but do not provide legal advice') further limits scope rather than expanding it.
INFO Canary files read by audit harness (not skill) -3 ▶
Six sensitive canary files were opened and read in two identical batches: once before the clone (timestamp 1786992244, pre-install baseline) and once after all skill files were examined (timestamp 1786992256, post-install check). The SKILL.md file contains no file-access instructions and no executable content. The symmetric access pattern across both phases is characteristic of the audit harness performing integrity checks rather than skill-induced exfiltration. Canary integrity check confirms all files unmodified.
INFO Expected HTTPS clone from github.com -3 ▶
The install performed a shallow sparse clone from github.com (140.82.121.3:443), checked out only the target subpath, copied files, and removed the temp clone. No unexpected network destinations, no post-install callbacks, and the connection table is identical before and after install.
LOW Theoretical risk-score manipulation via substitution attack -10 ▶
The skill's numerical scoring framework (Severity × Likelihood matrix) could be weaponized by a malicious fork that subtly shifts thresholds or descriptions to normalize high-risk activities as medium/low. This is not a present threat in this skill, but users should ensure they are installing from the canonical Anthropics repository and pin to a specific commit hash to prevent silent updates.