domain-driven-advisor
Fail
Audited by Gen Agent Trust Hub on Jul 17, 2026
Risk Level: HIGHDATA_EXFILTRATIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill directs the agent to read
~/.claude/settings.json, a sensitive configuration file for the agent platform. Accessing platform-level configuration is a significant data exposure risk even without external exfiltration. - [COMMAND_EXECUTION]: The skill contains instructions to modify the global configuration file of the agent platform (
~/.claude/settings.json) to enable experimental features (CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS). Modifying configuration files that govern agent behavior is a high-risk pattern that can impact the security posture of the execution environment. - [PROMPT_INJECTION]: The skill processes untrusted data from the repository's file system to influence its decision-making logic, creating a surface for indirect prompt injection.
- Ingestion points: Repository file tree heuristics, directory names (e.g.,
migrations/,supabase/), and code import patterns in Step 1. - Boundary markers: None identified for separating scanned metadata from the agent's internal reasoning context.
- Capability inventory: Modifies global configuration files, executes external audit and remediation skills.
- Sanitization: No validation or sanitization is performed on the repository signals before they are used to determine which high-privilege audits are recommended or executed.
Recommendations
- AI detected serious security threats
Audit Metadata