extract
Warn
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands (
grep,sed,pwd) to search local directories. It specifically targets the$HOME/.claude/projects/directory to locate and extract project-specific memory files. - [DATA_EXFILTRATION]: Accesses internal application directories located at
~/.claude/projects/. These directories contain historical project context, user interactions, and auto-memory entries which are read directly into the agent's active context. - [DYNAMIC_EXECUTION]: Employs shell command substitution
$(pwd | sed ...)to dynamically compute file paths at runtime. Additionally, the skill references spawning a secondaryskill-extractoragent for automated file generation, representing dynamic agent-to-agent task delegation. - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: Data is ingested from user-provided descriptions and external project memory files discovered via shell searches (SKILL.md, Step 1).
- Boundary markers: Absent. The skill does not define delimiters or specific warnings to ignore instructions that might be embedded within the content retrieved from memory files.
- Capability inventory: Includes file reading (shell
grep), directory navigation, dynamic agent invocation, and file system write operations. - Sanitization: While the skill includes "Quality gates" (Step 6) to manually check for hardcoded credentials or project-specific paths, there is no automated sanitization or escaping of the external content before it is processed by the agent.
Audit Metadata