CLAUDE.md Auto Discovery

• Outcome: Review
• Latest audit: May 28, 2026 · 9:25 AM UTC
• Version: 0.1.0

Overview

This skill appears designed to automatically load local CLAUDE.md guidance into agent context, but it does so broadly and without enough user control or trust boundaries.

Review before installing. Only use this in repositories and parent directories you trust, because a CLAUDE.md or included file could silently influence the agent. Prefer an opt-in workflow that shows which files will be loaded, limits discovery to the intended project root, and treats loaded content as untrusted project guidance rather than privileged instructions.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

High

• Confidence: 98% confidence
• Finding: The skill is configured to run automatically on every user message, which is an overly broad trigger for a capability that traverses directories, reads project files, parses includes, and injects the resulting content into system context. This materially increases the chance of unintended prompt/context poisoning, disclosure of sensitive repository instructions, and privilege escalation through untrusted CLAUDE.md content.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The description omits a clear warning that the skill automatically reads CLAUDE.md files, follows @include directives, and injects their contents into system context. In this context, that lack of disclosure is dangerous because users may not realize untrusted repository files can influence model behavior, enabling prompt injection and accidental exposure of sensitive local instructions or data.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill automatically discovers and loads `CLAUDE.md` files from the current and parent directories, then prints their contents for injection into higher-privilege system context without any warning, consent, or trust validation. In an agent setting, this creates a prompt-injection channel where a repository or ancestor directory can silently supply adversarial instructions that override user intent or manipulate downstream model behavior.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This script automatically discovers CLAUDE.md files in the current and parent directories and prints their full contents to stdout without any confirmation, redaction, or disclosure. In an agent/tooling context, CLAUDE.md often contains system prompts, internal instructions, secrets, or sensitive workflow context, so automatic exfiltration to logs or downstream consumers can leak confidential data across trust boundaries.

Static analysis

No suspicious patterns detected.