promote
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill graduates content from 'MEMORY.md' (auto-memory) into project rules like 'CLAUDE.md'. This process lacks explicit validation or sanitization, potentially allowing unintended behaviors or poisoned instructions from previous sessions to become persistent, high-priority rules for the agent.
- Ingestion points: Reads from 'MEMORY.md' within the '$HOME/.claude/projects/' directory (SKILL.md, Step 2).
- Capability inventory: Performs shell commands ('grep') and file write operations to core configuration files ('CLAUDE.md', '.claude/rules/').
- Boundary markers: The skill does not define specific delimiters or instructions to ignore potential injections within the source text.
- Sanitization: None provided; the skill relies on LLM 'distillation' to format rules, which can be bypassed by sophisticated inputs.
- [COMMAND_EXECUTION]: The skill uses shell commands ('grep', 'sed', 'pwd') to interact with the agent's internal filesystem and state. These commands interpolate variables derived from user-supplied pattern descriptions, which could lead to command injection if the user input contains shell metacharacters like semicolons or backticks.
Audit Metadata