second-brain

Warn

Audited by Gen Agent Trust Hub on May 14, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to set up automated persistence and background tasks using system utilities like cron, systemd, or launchd when an automated synchronization workflow is requested.
  • [EXTERNAL_DOWNLOADS]: The skill requires several external packages and CLI tools for content ingestion, specifically recommending installations via npm (such as agent-browser) and pip (such as yt-dlp and pdfplumber), and relies on specialized tools like defuddle and xurl for data extraction.
  • [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because its core functionality involves the ingestion and synthesis of unvalidated data from the web.
  • Ingestion points: Data is pulled from Twitter threads, YouTube transcripts, and various web URLs into a raw/ staging area before being processed into the knowledge base.
  • Boundary markers: The instructions lack specific guidance on using delimiters or protective prompts to prevent the agent from executing instructions potentially hidden within the fetched content.
  • Capability inventory: The agent possesses the capability to execute shell commands, perform network requests, and modify files across the local filesystem.
  • Sanitization: The skill does not prescribe any validation or sanitization procedures for ingested content before it is incorporated into the canonical knowledge base.
Audit Metadata
Risk Level
MEDIUM
Analyzed
May 14, 2026, 03:11 PM
Security Audit — agent-trust-hub — second-brain