kamae
Pass
Audited by Gen Agent Trust Hub on Aug 7, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill instructions in SKILL.md (Step 0) mandate loading and applying external rules from
.claude/rules/*.mdand~/.claude/rules/*.md. This creates an indirect prompt injection surface where instructions embedded in project files can override the skill's intended logic and behavior.\n - Ingestion points: Rules are globbed and read from project-local and user-global directories as defined in SKILL.md.\n
- Boundary markers: No markers are defined to isolate these rules from the agent's primary instruction set; the agent is explicitly told to "Apply the body of each surviving rule throughout the remaining steps."\n
- Capability inventory: These rules can override library detection, code generation conventions, and topic guidance, creating a significant control surface.\n
- Sanitization: There is no mechanism to sanitize or validate the content of the loaded rule files before they are applied as instructions.
Audit Metadata