How to use the Skill Trust Checker agent skill (skills-qa)

What the Skill Trust Checker makes the agent do

When you ask Claude to evaluate a skill, this skill tells it to check that skill against the Legal Skill Design Framework. The framework has thirteen design parameters. The first nine cover substantive design. The tenth, Trust Surface, covers execution permissions and injection risk. The eleventh, Freshness, asks whether bundled reference content is current. The twelfth, Schema, asks whether the SKILL.md has the structure a well-built skill needs. The thirteenth, Conflicts, asks whether the skill overlaps or conflicts with skills you already have installed.

Before the design review, the skill runs a prompt-injection heuristic scan over every file it can read. It looks for override instructions, false authority claims, instructions to change config files, out-of-scope file reads and writes, unexpected URLs, hidden content and credential requests. It also flags any overclaiming of legal authority. The output is a verdict in one of three bands: Ready, Some Concern, or Material Concerns.

Install the skill from the ZIP or the Claude apps

There are two ways to add this skill. The first is to download the ZIP from this directory page and unzip it into your skills folder. Use ~/.claude/skills/ for a personal install, or the .claude/skills/ folder inside a project for a project-only install.

The second is to upload the ZIP in the Claude apps. Open Settings, go to Capabilities, then choose Skills and upload the file there.

• Personal install: unzip into ~/.claude/skills/
• Project install: unzip into the project's .claude/skills/ folder
• Claude apps: Settings → Capabilities → Skills, then upload the ZIP

Check what you need before you run it

The skill is part of the claude-for-legal legal-builder-hub plugin, so Claude Code or a compatible agent with that plugin installed is required. You also need access to the skill folder or the pasted SKILL.md content.

For overlap checking, the skill reads your practice profile and installed skills list from ~/.claude/plugins/config/claude-for-legal/legal-builder-hub/CLAUDE.md. This file is optional. Without it, the skill can still evaluate design and run the injection scan, but the dependency and overlap check cannot be fully completed.

• Claude Code or a compatible agent
• The claude-for-legal legal-builder-hub plugin installed
• The skill folder, or the SKILL.md pasted into the conversation
• Optional: the legal-builder-hub CLAUDE.md for overlap checks

Trigger the skill with natural requests

You do not need a special command. Ask in plain language, and name the skill you want reviewed. The skill's description says it is meant for requests such as 'should I trust this?' or 'is this skill well-designed?'.

You can also point it at a path. The argument hint accepts a skill path, a SKILL.md path, or pasted content. If you have just run the skill installer and then ask whether the result is trustworthy, the request should route to this skill.

• 'Should I trust this skill before I install it?' followed by the path or pasted SKILL.md
• 'Is this skill well-designed? Here is the SKILL.md.'
• 'Review this community skill for injection risks before our team deploys it.'

Read the verdict and the findings

The result is one of three bands: Ready, Some Concern, or Material Concerns. Read the findings behind the band, not just the band itself. Each injection finding should list the file path, line numbers, the quoted text and the pattern category, so a person can check it directly.

Treat a clean result as a signal, not an approval. The scan is an AI heuristic and cannot guarantee a skill is safe. The skill's own text says that a clean scan is not an approval, and that a human should still review the diff before any update is applied.

Safety notes: scripts and network

This skill runs no scripts and uses no network access, according to its listing. It works by reading the files you provide and reasoning over them.

Because it is an AI heuristic, it can miss injections worded in ways its checklist does not anticipate. It is also designed for legal skills, so findings on non-legal skills may be less relevant. Use it as one layer of review alongside your own reading and your team's approval process.