extract

Warn

Audited by Gen Agent Trust Hub on Aug 30, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes shell commands (grep, sed, pwd) to search local directories. It specifically targets the $HOME/.claude/projects/ directory to locate and extract project-specific memory files.
  • [DATA_EXFILTRATION]: Accesses internal application directories located at ~/.claude/projects/. These directories contain historical project context, user interactions, and auto-memory entries which are read directly into the agent's active context.
  • [DYNAMIC_EXECUTION]: Employs shell command substitution $(pwd | sed ...) to dynamically compute file paths at runtime. Additionally, the skill references spawning a secondary skill-extractor agent for automated file generation, representing dynamic agent-to-agent task delegation.
  • [INDIRECT_PROMPT_INJECTION]:
  • Ingestion points: Data is ingested from user-provided descriptions and external project memory files discovered via shell searches (SKILL.md, Step 1).
  • Boundary markers: Absent. The skill does not define delimiters or specific warnings to ignore instructions that might be embedded within the content retrieved from memory files.
  • Capability inventory: Includes file reading (shell grep), directory navigation, dynamic agent invocation, and file system write operations.
  • Sanitization: While the skill includes "Quality gates" (Step 6) to manually check for hardcoded credentials or project-specific paths, there is no automated sanitization or escaping of the external content before it is processed by the agent.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Aug 30, 2026, 03:47 AM
Security Audit — agent-trust-hub — extract