agents-md-improver
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's core functionality involves ingesting untrusted user feedback to update repository instruction files. This creates a surface for indirect prompt injection where a user or potentially a collaborator could influence the agent's future behavior by injecting malicious rules into the documentation. However, this is the intended purpose of the skill, and the risk is mitigated by a mandatory "propose-first" workflow that requires explicit human review and confirmation before any file changes are committed.
- Ingestion points: Reads repo-local files
AGENTS.md,CLAUDE.md,.claude/CLAUDE.md, andGEMINI.md. - Boundary markers: None explicitly mentioned for content ingestion, but uses a confirmation step for the output.
- Capability inventory: Repo-local file read/edit, file deletion, and symlink creation.
- Sanitization: Employs a propose-first confirmation workflow to ensure human oversight.
- [SAFE]: The skill operates within a restricted scope, explicitly ignoring system-wide configuration files and focusing only on repository-local documentation. It does not perform network operations, execute remote code, or access sensitive credentials.
Audit Metadata