personal-assistant
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill maintains a persistent local database of user-provided information such as tasks, goals, and notes. It retrieves this data to influence the agent's future responses, which creates a surface for indirect prompt injection if the stored content contains malicious instructions that the agent might follow upon retrieval.
- Ingestion points: Data is loaded from
profile.json,tasks.json,schedule.json, andcontext.jsonvia theassistant_db.pyscript and provided to the agent as context as described inSKILL.md(Steps 3 and 4). - Boundary markers: The instructions in
SKILL.mddo not specify the use of delimiters or warnings to ignore embedded instructions when the agent processes the retrieved data. - Capability inventory: The agent has the capability to execute shell commands via the provided scripts and perform file read/write operations on the local system.
- Sanitization: There is no evidence of sanitization or validation of the stored strings to ensure they are not interpreted as instructions by the model.
Audit Metadata