setup-agent-skills
Warn
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill automates the configuration of project-level hooks for AI agents (Codex and Claude Code). It modifies configuration files like
.claude/settings.jsonand.codex/hooks.jsonto execute shell commands (node docs/agents/project-knowledge.mjs hook) triggered by events such asUserPromptSubmit,SessionStart, andSubagentStart. This effectively establishes a persistence mechanism where the skill's custom logic is automatically executed across different sessions within the repository. - [PROMPT_INJECTION]: The skill facilitates the ingestion of project-specific rules and context documents into the agent's prompt, creating a surface for indirect prompt injection if the files located in
docs/CONTEXT.mdordocs/rules/are modified to include malicious instructions. - Ingestion points:
docs/CONTEXT.md,docs/CONTEXT-MAP.md, and Markdown files underdocs/rules/and their recursive references. - Boundary markers: The
project-knowledge.mjsscript wraps the content of loaded files with semantic headers such as## CONTEXT <description>,## RULE <id> · <title>, and## REFERENCE <path>. - Capability inventory: The skill explicitly instructs the agent that loaded rules "must be followed" (
必须遵守). The environment handles automated script execution and file modification as part of the setup. - Sanitization: The script performs structural validation but does not sanitize the natural language content of the rules themselves.
Audit Metadata