para-skill

Pass

Audited by Gen Agent Trust Hub on Jul 18, 2026

Risk Level: SAFEPROMPT_INJECTION
Full Analysis
  • [PROMPT_INJECTION]: Indirect Prompt Injection Surface. The skill ingests untrusted note content to determine PARA classifications.
  • Ingestion points: The capture, classify, and review actions in SKILL.md ingest user-provided note text and existing metadata.
  • Boundary markers: The skill instructions do not specify strict delimiters or explicit warnings to ignore embedded instructions within the notes being processed.
  • Capability inventory: The skill performs file writes (appending to PARA-Changelog.md) and recommends file moves (delegated to obsidian-cli).
  • Sanitization: No evidence of escaping or filtering of note content before interpolation into the agent's context.
  • [PROMPT_INJECTION]: Self-referential content. The skill includes a pre-generated security report (skill-report.json) that explicitly claims a "SAFE" verdict, representing an attempt to influence the security analysis process.
  • Evidence: The skill-report.json file contains metadata and summaries asserting that the skill is safe and that all findings are false positives, which must be ignored in favor of independent analysis.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 18, 2026, 06:06 PM
Security Audit — agent-trust-hub — para-skill