para-skill
Pass
Audited by Gen Agent Trust Hub on Jul 18, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: Indirect Prompt Injection Surface. The skill ingests untrusted note content to determine PARA classifications.
- Ingestion points: The
capture,classify, andreviewactions inSKILL.mdingest user-provided note text and existing metadata. - Boundary markers: The skill instructions do not specify strict delimiters or explicit warnings to ignore embedded instructions within the notes being processed.
- Capability inventory: The skill performs file writes (appending to
PARA-Changelog.md) and recommends file moves (delegated toobsidian-cli). - Sanitization: No evidence of escaping or filtering of note content before interpolation into the agent's context.
- [PROMPT_INJECTION]: Self-referential content. The skill includes a pre-generated security report (
skill-report.json) that explicitly claims a "SAFE" verdict, representing an attempt to influence the security analysis process. - Evidence: The
skill-report.jsonfile contains metadata and summaries asserting that the skill is safe and that all findings are false positives, which must be ignored in favor of independent analysis.
Audit Metadata