init-rulebook
Warn
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: MEDIUMPERSISTENCECOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PERSISTENCE]: The skill is designed to modify the agent host's persistent startup instructions (e.g., ~/.codex/AGENTS.md or application-specific rules) to ensure the rulebook is automatically invoked at the start of every session and after context compaction.
- [COMMAND_EXECUTION]: During the update process, the skill instructs the agent to "Follow repository-level installation documentation for installer commands." This guidance to execute arbitrary commands found in external documentation is a high-risk pattern.
- [REMOTE_CODE_EXECUTION]: The update functionality facilitates fetching content from a remote repository and executing installation steps defined in that repository's documentation, creating a vector for remote code execution.
- [INDIRECT_PROMPT_INJECTION]: The skill's primary operation involves reading and applying instructions from external markdown files (AGENTS.md and linked rules).
- Ingestion points: ~/.agents/AGENTS.md and linked rule files in rules/*.md (specified in SKILL.md).
- Boundary markers: Absent; instructions direct the agent to "Read complete selected files" and "Follow its declared structure" without warnings to ignore or delimit potentially malicious embedded instructions.
- Capability inventory: Includes file system write access (creating links and modifying host instructions), command execution (via update mode), and persistent modification of agent startup behavior.
- Sanitization: No evidence of content validation, escaping, or filtering of the ingested instructions.
- [EXTERNAL_DOWNLOADS]: The skill includes functionality to download updates for itself or a user's rulebook from remote GitHub repositories or published package sources.
Audit Metadata