new-workspace
Fail
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: HIGHDATA_EXFILTRATIONCOMMAND_EXECUTIONCREDENTIALS_UNSAFEPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill extracts local system metadata and user identity facts from
~/.claude/CLAUDE.mdand embeds them into a new workspace file. By default, this workspace is pushed to a public GitHub repository (gh repo create --public --push), leading to the automatic disclosure of potentially sensitive local environment details. - [COMMAND_EXECUTION]: User-supplied inputs from
$ARGUMENTS(such as workspace name and parent path) are directly interpolated into shell commands includingmkdirandgh repo create. The absence of sanitization or escaping creates a vulnerability to command injection if a malicious name or path is provided. - [CREDENTIALS_UNSAFE]: The skill accesses
~/.claude/CLAUDE.md, a sensitive configuration file used by the agent to store user identity facts and system metadata. Accessing and then publicly publishing this information presents a high privacy risk. - [PROMPT_INJECTION]: Step 6 of the procedure creates an indirect prompt injection surface by prompting the user for machine-specific facts (e.g., "role", "hostname") and writing them directly into the workspace's
CLAUDE.mdfile, which provides operational instructions to the agent.
Recommendations
- AI detected serious security threats
Audit Metadata