daily-update
Warn
Audited by Gen Agent Trust Hub on May 10, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill establishes persistence by modifying system configuration files. In its setup mode, it appends a command to
~/.zshrcto source an external shell script and installs alaunchdplist file into~/Library/LaunchAgents/to schedule recurring background tasks. It also useslaunchctlto load these agents. - [COMMAND_EXECUTION]: The skill executes local shell scripts and system utilities. It runs maintenance scripts from the
$OBSIDIAN_WIKI_REPOdirectory and utilizes tools likefind,sed, andbashto perform vault reconciliation and state management. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its processing of untrusted local data.
- Ingestion points: Content is read from the user's Obsidian vault (
$OBSIDIAN_VAULT_PATH) during both the index refresh and thehot.mdregeneration steps. - Boundary markers: There are no explicit delimiters or instructions provided to the agent to ignore or isolate embedded instructions within the vault markdown files.
- Capability inventory: The skill possesses significant capabilities, including writing to various vault files, modifying shell startup scripts (
.zshrc), and installing system-level persistence agents (launchd). - Sanitization: No sanitization, validation, or filtering of the ingested vault content is performed before it is used to generate the semantic snapshot in
hot.md.
Audit Metadata