skills-qa

To evaluate legal skill safety, validate its SKILL.md frontmatter and scan for prompt-injection and trust-boundary risks. This quality assurance process checks design quality, dependency mapping, and trigger awareness, producing a readiness, concern, or refuse deployment decision.

Prompt injection risk scanning for legal skills detects suspicious instructions, hidden payloads, out-of-scope reads/writes, network calls, and authority overclaims. This heuristic evaluation surfaces trust and safety vulnerabilities before you install or deploy community skills into legal workflows.

Mapping dependencies and triggers in a legal skill directory requires reading the SKILL.md entry instructions alongside related commands, agents, and hooks. This dependency mapping explains what the skill relies on and identifies potential downstream workflow deployment conflicts.

Yes, QA evaluation applies to first-party legal skills by checking design quality against a framework covering audience fit, delegation thresholds, trust boundaries, and conflict risks. It produces a readiness decision and prioritized fixes for workflow deployment.

Heuristic scanning for legal skill trust boundaries identifies potential prompt injection and out-of-scope operations but cannot guarantee complete safety. It surfaces suspicious instructions and dependency conflicts, yet complex hidden payloads may still evade detection during workflow deployment.

Yes, providing the skill directory path including its SKILL.md is required to run a legal skill readiness check. The QA evaluation needs to read the entry instructions plus related commands, agents, and hooks to produce a deployment decision.