claude-code
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process user queries and provide relevant information from local reference files. This creates a surface for indirect prompt injection, as the agent must interpret untrusted user input to select the appropriate documentation context.
- Ingestion points: User questions regarding tool setup, commands, and features as defined in the activation examples in
SKILL.md. - Boundary markers: The skill relies on standard instruction-following rather than explicit delimiters for user input in the provided examples.
- Capability inventory: The documentation references capabilities of the Claude Code tool, including filesystem modifications (
write,edit) and shell command execution (bash). - Sanitization: The instructions emphasize user review of scripts and plugins as a security measure.
- [EXTERNAL_DOWNLOADS]: The documentation describes installation procedures for the Claude Code CLI and its extensions (plugins and MCP servers) from external sources. These references target well-known package registries and trusted organizations.
- Evidence: References to
@anthropic-ai/claude-code(NPM),claude-code(PyPI), and various@modelcontextprotocol/packages inreferences/getting-started.mdandreferences/mcp-integration.md. - [COMMAND_EXECUTION]: The skill contains a large catalog of shell commands and slash commands (e.g.,
/cook,/fix:hard,/git:cm,/deploy) intended for user guidance. These commands demonstrate how to interact with the Claude Code terminal interface and perform development workflows. - Evidence: Detailed usage examples and command descriptions across
references/slash-commands.md,references/best-practices.md, andreferences/troubleshooting.md.
Audit Metadata