rule-creator
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes bundled Python 3 scripts, specifically resolve_memory.py and rules_index.py, to facilitate rule indexing and import resolution. It also uses standard shell commands such as rm for file removal and ln -s for creating symbolic links to shared rule files in the .claude/rules/ directory.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from untrusted project files like CLAUDE.md and AGENTS.md during the rule extraction workflow. While the skill implements a classifier to distinguish declarative rules from procedural tasks, this workflow creates an ingestion surface for external instructions.
- Ingestion points: The resolve_memory.py script reads project-level memory files to process @path imports.
- Boundary markers: The skill identifies rule sections using Markdown H2 and H3 header structures.
- Capability inventory: The skill can read, write, and delete files in rule directories (~/.claude/rules/ and .claude/rules/) and create symlinks.
- Sanitization: Employs regex-based structural parsing for headers and frontmatter and uses a classification gate to ensure inputs describe conventions rather than workflows.
Audit Metadata