kamae-review
Pass
Audited by Gen Agent Trust Hub on Jun 26, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill implements a rule-loading mechanism that is susceptible to indirect prompt injection.
- Ingestion points: Instructions are loaded from files within the project directory (
.claude/rules/*.md) and the user's home directory (~/.claude/rules/*.md). - Boundary markers: There are no boundary markers or security instructions to prevent the agent from obeying malicious instructions embedded within these files.
- Capability inventory: The skill uses file reading and directory globbing to gather these rules, which then dictate which security checks (like PII protection or boundary validation) are active during the review.
- Sanitization: The skill lacks sanitization of the rule content, relying on simple YAML frontmatter parsing and priority tiering.
- Impact: An attacker could submit a pull request containing a rule that disables critical security checks, causing the agent to incorrectly report the code as safe.
Audit Metadata