AI Commands
Overview
Section titled “Overview”Evidence: AI Commands
Description: Parse custom AI slash-command definitions
Category: AI
Platform: macos
Short Name: aicmd
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No
Background
Section titled “Background”Claude Code and Cursor allow project and user custom slash-command markdown files. Those commands can embed shell instructions, automation, or prompt text that runs whenever an operator invokes them.
Data Collected
Section titled “Data Collected”This collector gathers structured data about custom AI slash-command definitions, including command path, name, and bounded redacted excerpts.
Collection Method
Section titled “Collection Method”This collector parses command frontmatter and bounded excerpts from project and user command directories while preserving raw files in Content.
Forensic Value
Section titled “Forensic Value”Identifies custom commands that embed dangerous shell instructions, prompt injection, or hidden automation that can execute during AI-assisted work.