map-project-monorepo
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill creates a surface for indirect prompt injection by aggregating metadata (names, descriptions, and triggers) from various files across the workspace into a central
CLAUDE.mdfile that guides agent behavior. - Ingestion points: The skill reads frontmatter from
.claude/skills/**/SKILL.mdfiles and configuration from.claude/settings.json,.claude/settings.local.json, and.mcp.json(as detailed inreferences/skills-and-mcp.md). - Boundary markers: Ingested content is formatted into Markdown tables within the
CLAUDE.mdfiles, which provides some structural separation but does not prevent the agent from following embedded instructions. - Capability inventory: The skill possesses
Read,Edit,Write, andBashcapabilities, which are used to discover project structure and persist the documentation. - Sanitization: The instructions explicitly direct the agent to "NEVER copy secrets, tokens, headers, or env values" into the generated documentation, which mitigates data exposure but does not explicitly sanitize the natural language metadata that could contain malicious directives.
Audit Metadata