knowledge-ops
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFEPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [PROMPT_INJECTION]: The skill enables the ingestion of data from untrusted external sources, such as browser bookmarks and GitHub activity, which creates a surface for indirect prompt injection. Malicious instructions embedded in these sources could potentially influence the agent's behavior when the knowledge is retrieved.
- Ingestion points: The 'Cross-Source Knowledge Sync' section explicitly instructs the agent to pull data from browser bookmarks and GitHub activity events.
- Boundary markers: The instructions lack specific delimiters or guardrails to treat the ingested external content as untrusted data rather than instructions.
- Capability inventory: The skill has the capability to write to local memory files and perform Git operations (commit and push).
- Sanitization: The skill includes guidance to redact sensitive information before storage, but does not specify sanitization for executable or instructional content within the ingested data.
- [DATA_EXFILTRATION]: The skill is designed to mirror local workspace configuration and session history to an external Git repository.
- Evidence: The 'Workspace State Sync' section directs the agent to mirror important workspace configuration and scripts to a knowledge base repository.
- Mitigation: The skill includes safety instructions to redact sensitive configuration, API keys, and passwords before committing and pushing to the remote repository.
Audit Metadata