froq-voice-essay
Fail
Audited by Gen Agent Trust Hub on Nov 11, 2026
Risk Level: HIGHDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill explicitly instructs the agent to access and process highly sensitive personal data.
- Evidence in
SKILL.md(Step 4) requires the agent to gather material from the user's "Arc history on his Macs" (browser history) and "bots' chat transcripts." - It further requests access to a Notion database ("Notion「随笔」database") to extract personal entries.
- This access pattern exposes significant private information to the agent's context, which could be misused if the agent's behavior is compromised.
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from several untrusted or externally-influenced sources, creating a vulnerability to indirect prompt injection.
- Ingestion points: The agent reads data from Notion, chat logs, browser history, and the external GitHub repository
0froq/0froq.github.ioas specified inSKILL.mdandreferences/STYLE.md. - Boundary markers: The instructions do not provide delimiters or specific warnings to ignore instructions that might be embedded within the retrieved entries or transcripts.
- Capability inventory: The skill has the capability to read local files, access network resources (Notion/GitHub), and modify its own configuration files (
references/STYLE.md). - Sanitization: There is no evidence of sanitization or filtering to prevent the agent from obeying commands found within the processed materials.
Recommendations
- AI detected serious security threats
Audit Metadata