[Feature]: Add detection for AI skill files and tool-use configurations #4
Description
Problem Description
AI coding agents like Claude Code, Codex, and others support "skill files" or "tool-use" configurations (e.g., CLAUDE.md, .cursorrules, .windsurfrules, .github/copilot-instructions.md, codex.md) that influence how AI agents behave within a project or globally. These files can define custom instructions, inject system prompts, or configure tool access and they can be committed to repositories or placed in home directories without visibility to security teams. A malicious or misconfigured skill file could instruct an AI agent to exfiltrate data, modify code in unexpected ways, or bypass security guardrails. Currently, Dev Machine Guard has no visibility into these configurations.
Proposed Solution
Add a new scan category (e.g., "AI Skill Files" or "AI Tool Configurations") that inventories skill/instruction files across the developer machine.
Alternatives Considered
No response
Additional Context
No response