context-discovery
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and strictly follow instructions from external files discovered at runtime, which could contain malicious prompts.
- Ingestion points: Files such as navigation.md, code-quality.md, and security-patterns.md are read from project-local and global directories.
- Boundary markers: Absent. The skill does not define delimiters or instructions to ignore embedded prompts in discovered files.
- Capability inventory: SKILL.md performs file read operations and Invoke commands to subagents; context-discovery-protocol.md signals the main agent to write .oac.json files.
- Sanitization: Absent. There is no validation or filtering of content ingested from the discovered files.
- [DATA_EXFILTRATION]: The discovery protocol accesses multiple directory layers including the user's home directory (~/.claude/context) to locate configuration files, which could lead to unauthorized file access if path traversal or misconfiguration occurs.
Audit Metadata