project-capabilities
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes the
claude plugin listcommand using Bash to identify currently installed plugins and incorporate them into the project inventory. - [PROMPT_INJECTION]: The skill creates an indirect prompt injection surface by ingesting untrusted data from the project environment and re-broadcasting it into a persistent configuration rule.
- Ingestion points: Metadata, specifically the
nameanddescriptionfields, is extracted from the frontmatter of allSKILL.mdfiles located in the.claude/skills/directory. - Boundary markers: The generated
baseline-project-capabilities.mdrule file lacks delimiters or specific instructions (e.g., 'ignore embedded commands') to prevent an agent from obeying malicious instructions hidden within a skill's description. - Capability inventory: The skill has the ability to read the filesystem, execute local shell commands, and write new rule files to the
.claude/rules/directory. - Sanitization: No sanitization, escaping, or validation is performed on the ingested metadata before it is interpolated into the final rule file.
Audit Metadata