second-brain
Warn
Audited by Gen Agent Trust Hub on May 14, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to set up automated persistence and background tasks using system utilities like
cron,systemd, orlaunchdwhen an automated synchronization workflow is requested. - [EXTERNAL_DOWNLOADS]: The skill requires several external packages and CLI tools for content ingestion, specifically recommending installations via
npm(such asagent-browser) andpip(such asyt-dlpandpdfplumber), and relies on specialized tools likedefuddleandxurlfor data extraction. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because its core functionality involves the ingestion and synthesis of unvalidated data from the web.
- Ingestion points: Data is pulled from Twitter threads, YouTube transcripts, and various web URLs into a
raw/staging area before being processed into the knowledge base. - Boundary markers: The instructions lack specific guidance on using delimiters or protective prompts to prevent the agent from executing instructions potentially hidden within the fetched content.
- Capability inventory: The agent possesses the capability to execute shell commands, perform network requests, and modify files across the local filesystem.
- Sanitization: The skill does not prescribe any validation or sanitization procedures for ingested content before it is incorporated into the canonical knowledge base.
Audit Metadata