init-claude-md
Pass
Audited by Gen Agent Trust Hub on Jul 27, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands like
ls,cat, andgrepto inspect project files such aspackage.json,README.md, and dependency manifests. These are standard operations for a build/init tool to identify stack and commands. - [PROMPT_INJECTION]: The skill processes content from untrusted local files (e.g.,
README.md), creating a surface for indirect prompt injection where malicious instructions in project files could influence agent behavior. - Ingestion points: Reads local project files including
package.json,README.md,Cargo.toml,requirements.txt,go.mod, andMakefilein SKILL.md. - Boundary markers: No explicit delimiters or boundary markers are used when reading external file content.
- Capability inventory: Shell command execution (
ls,cat,grep) and file writing (Write a CLAUDE.md). - Sanitization: The skill does not perform sanitization or filtering of the content read from files before processing.
Audit Metadata