folder-specific-claude-and-agents-md
Pass
Audited by Gen Agent Trust Hub on Jul 20, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data to generate instructions.
- Ingestion points: The skill reads all markdown, config, and source files within a user-specified folder (as described in Step 2 of
SKILL.md). - Boundary markers: There are no explicit instructions or delimiters used to prevent the agent from obeying instructions embedded within the files it reads.
- Capability inventory: The agent has the capability to execute shell commands (
ln -s) and perform Git operations (add,commit,push). - Sanitization: No sanitization or validation is performed on the content read from files before it is processed and written into the new context files.
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands directly.
- Evidence: Step 6 involves running
cd <folder> && ln -s CLAUDE.md AGENTS.md. Step 7 involves Git commands likegit add -A. While these are functional for the skill's purpose, they represent a command execution surface that depends on the agent's underlying safety filters for path and argument handling.
Audit Metadata