claude-settings-audit
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes common system commands like
ls,find, andcatto perform directory exploration and file inspection. These commands are used solely for identifying project indicators (e.g., lock files, configuration files) and do not perform state-modifying actions. - [INDIRECT_PROMPT_INJECTION]: The skill parses content from untrusted repository files, including
package.json,pyproject.toml, and.claude/settings.json, to build its recommendation engine. This processing of external data constitutes a vulnerability surface where a malicious repository could attempt to subvert the agent's audit logic through hidden instructions in dependency files. - Ingestion points: Tech stack detection (Phase 1), service detection (Phase 2), and existing settings review (Phase 3).
- Boundary markers: The skill does not explicitly use delimiters or "ignore instructions" prompts when reading these files.
- Capability inventory: The skill relies on read-only bash commands for its own execution, though it may recommend allowing broader tools like
gh apiin the final output. - Sanitization: No specific sanitization or filtering of file content was identified before it is used to generate recommendations.
Audit Metadata