eviction-risk
Warn
Audited by Gen Agent Trust Hub on Mar 23, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DATA_EXFILTRATION]: The skill instructs the agent to access
~/.claude/projects/to find project memory and log telemetry. Accessing the agent's own internal project or state directories in the user's home directory is a sensitive operation that could expose metadata about other projects or allow the skill to persist data across sessions outside the intended project scope. - [COMMAND_EXECUTION]: The 'SELF-EVOLUTION TELEMETRY' section directs the agent to perform file append operations to
skill-telemetry.mdwithin the~/.claude/projects/directory. - [PROMPT_INJECTION]: The skill exhibits a significant indirect prompt injection surface as its primary function is to ingest and analyze untrusted codebase content.
- Ingestion points: Reads project configuration, data models, and codebase files during the 'SYSTEM DISCOVERY' phase.
- Boundary markers: Absent. The prompt does not instruct the agent to distinguish between its own core instructions and instructions that may be embedded in the analyzed code or configuration files.
- Capability inventory: Includes file system read operations across the entire project and file system write operations for telemetry logging.
- Sanitization: There is no evidence of sanitization or escaping of the ingested codebase content before it is processed by the agent.
Audit Metadata