claude-project-manifest
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is a documentation and knowledge management tool that provides structured templates (YAML/JSON) and guidelines. No executable code is shipped that runs automatically; the provided Python and Shell snippets are educational examples for the user to implement locally.
- [INDIRECT_PROMPT_INJECTION]: While the skill is designed to ingest project data (file paths, thread summaries) into a manifest, which is a common attack surface for indirect injection, the risk is negligible as it serves a purely documentation-focused purpose and provides guidance on using safe YAML loading practices (
yaml.safe_load).
Audit Metadata