菜单
Use when users say "is this legal AI app local-first", "what leaves the machine", "BYOK privacy", "audit network calls", "where are documents stored", or need a legal AI workspace reviewed for local storage, credentials, model-provider calls, conversion, and privacy boundaries.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/ThomasMoreAI/legal-skills-open --skill local-first-legal-workspace命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Use when retrieving arbitration institutional rules (ICC, LCIA, SCC, SIAC, HKIAC, VIAC, МКАС/МАК при ТПП України, UNCITRAL) — fetching current version, verifying redaction applicable to the date of arbitration agreement, constructing URLs for official rule texts
Use when choosing the Polish legal regime for letters, requests, applications, complaints, petitions, public-information requests, KPA filings, PPSA complaints, RODO access requests, registry extracts, court-file access, tax/ZUS/cudzoziemcy/USC procedures, or professional lawyer letters. Prevents mixing UDIP, KPA, PPSA, RODO, registry, special-procedure, and advocate/radca letter regimes.
Use when preparing applications for recognition and enforcement of foreign arbitral awards in Poland, applications for setting aside arbitral awards under KPC art. 1205–1211, or opposing such applications — mapping Article V of the 1958 New York Convention to art. 1214–1215 of the Polish KPC, identifying grounds for refusal, structuring public policy arguments
基于 SOC 职业分类
正在显示 SKILL.md
| name | local-first-legal-workspace |
| title | local-first-legal-workspace |
| description | Use when users say "is this legal AI app local-first", "what leaves the machine", "BYOK privacy", "audit network calls", "where are documents stored", or need a legal AI workspace reviewed for local storage, credentials, model-provider calls, conversion, and privacy boundaries. |
| author | LegalQuants |
| author_url | https://github.com/LegalQuants/lq-skills/tree/main/skills/local-first-legal-workspace |
| license | Apache-2.0 |
| version | 0.1.0 |
| execution_mode | open |
| jurisdiction | general |
| practice | general |
| language | en |
| tags | ["local-first","privacy","legal-ai","document-management","byok","security"] |
This skill is a design and audit checklist. It is not a claim that local-first equals risk-free.
Audience: legal-technology counsel, privacy/security-aware lawyers, and legal engineers reviewing a legal AI workspace with technical input where needed.
Work shape: pattern-matched audit when evidence exists; accretive design review when the user is designing a workflow. Keep those paths separate in the output.
This skill works in three modes:
If code, runtime evidence, or provider documentation is unavailable, mark claims unknown or not_observed_not_excluded. Do not treat a product's privacy statement as verified architecture.
Identify where local data lives:
Prefer one user-chosen workspace folder so backup, deletion, and migration are understandable.
List every possible external call:
For each call, record:
| Field | Meaning |
|---|---|
| destination | host or service |
| trigger | what user action causes it |
| payload | what data is sent |
| credential | whose key or token is used |
| retention | known retention posture |
| opt-out | whether user can disable it |
| evidence | code path, config file, package, provider documentation, policy URL, or runtime observation supporting the row |
| retrieval_date | date external provider terms or documentation were checked |
Do not assert that there are no hidden network paths unless code, dependency, configuration, and runtime evidence has been checked. If a path is not observed but not exhaustively verified, mark not_observed_not_excluded; if unknown, mark unknown.
Check:
For legal users, produce a short note:
Plain English matters. A lawyer should be able to explain the risk to a client, judge, supervisor, or DPO.
Output as:
local_state_map table: data type, path/location, sensitivity, deletion method, backup implication.external_calls table using the fields above.credential_handling summary.user_disclosure_note in plain English.unknowns_and_verification_needed.Add an overall confidence band to user_disclosure_note:
Apply the same High/Medium/Low band to the overall disclosure note and separately preserve row-level evidence states (observed, user_reported, provider_documentation, unknown, not_observed_not_excluded).
Flag:
Stop and route to privacy counsel, a security engineer, or the system owner when plaintext credentials are found, marketing/privacy claims contradict code or runtime evidence, unexpected outbound destinations appear, provider retention terms are missing for client data, or the user wants a client-facing assurance without runtime evidence.
Audit this legal AI app's privacy boundary. Tell me what stays local, what leaves the machine, and what the user must understand before processing confidential documents.
For a compact output pattern, see examples/output.md.
For workspace boundary, BYOK, network inventory, and conversion-risk conventions, see references/local-first-model.md.