rules-install
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONPERSISTENCE
Full Analysis
- [COMMAND_EXECUTION]: The skill probes the local environment for executable files such as
claude,codex,opencode,pi, andgrok. It also executes diagnostic commands likegrok inspectto resolve specific configuration paths and instruction sources. - [INDIRECT_PROMPT_INJECTION]: The skill ingest user-provided instruction text and writes it into the global rules of other agents. The instructions explicitly direct the agent to treat this content as 'opaque' without sanitization or modification, which could facilitate the delivery of malicious prompts to other agent environments.
- Ingestion points: User-provided role text collected at runtime in
SKILL.md. - Boundary markers: Uses specific markers
<!-- rules-install:begin -->and<!-- rules-install:end -->to delimit changes. - Capability inventory: File read/write access to user home directory configuration files and execution of local binaries.
- Sanitization: None; the skill is instructed to preserve the exact text provided by the user.
- [PERSISTENCE]: The skill modifies persistent configuration files (e.g.,
~/.claude/rules/rules-install.md,~/.codex/AGENTS.md) that are loaded every time the target coding agents are started. This ensures that any changes to the agent's behavior remain active across multiple sessions until manually reverted.
Audit Metadata