spec-rules-init
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function involves aggregating instructions from external, untrusted project files and other installed skills, which creates a surface for indirect prompt injection.
- Ingestion points: The skill reads data from files such as
CLAUDE.md,AGENTS.md, andSKILL.mdfiles located in the~/.claude/skills/directory (Step 1 and Step 3). - Boundary markers: While the generated output follows structured templates, the instructions do not specify mechanisms for sanitizing or isolating potentially malicious instructions extracted from source files before they are written to
coding-rules.md. - Capability inventory: The skill utilizes file system operations including
ls,find, and file read/write capabilities to scan and modify project documentation. - Sanitization: There is no evidence of logic designed to filter or escape natural language instructions found in analyzed project files before they are written to the final output files.
- Context: The risk is mitigated by the interactive nature of the skill, which prompts for user confirmation before including rules from other skills or overwriting existing files.
Audit Metadata