Automatically discovers and loads CLAUDE.md files from the project root, supporting @include directives and reverse loading up to 40,000 characters.

This skill reads CLAUDE.md files from the repository (up to 4 parent directories), concatenates them, and injects the text into the agent's system context. It does not make network calls or request credentials. Before enabling: (1) review your repository's CLAUDE.md files for any sensitive data (secrets, tokens, private notes), because those will be included in the agent context; (2) note the skill auto-runs on user messages — enable it only for workspaces/repos you trust; (3) be aware implementations check for a file named with a leading space (' CLAUDE.md') which is unusual but harmless. If you need different traversal depth or stricter filtering of loaded content, request or inspect modifications before use.

Type: OpenClaw Skill Name: claude-md-auto Version: 0.1.0 The skill automates the discovery and loading of 'CLAUDE.md' files into the agent's system context, which is a high-risk behavior that facilitates indirect prompt injection attacks. While the implementation in 'claude-md.py' and 'discover.mjs' is straightforward file reading, the instructions in 'SKILL.md' to automatically inject unsanitized external content into the system prompt represent a significant security vulnerability. Furthermore, 'SKILL.md' claims to support an '@include' directive that is not actually implemented in the provided code, and it includes an unusual search for files with leading spaces (' CLAUDE.md').