daily-update

Warn

Audited by Gen Agent Trust Hub on May 10, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill establishes persistence by modifying system configuration files. In its setup mode, it appends a command to ~/.zshrc to source an external shell script and installs a launchd plist file into ~/Library/LaunchAgents/ to schedule recurring background tasks. It also uses launchctl to load these agents.
  • [COMMAND_EXECUTION]: The skill executes local shell scripts and system utilities. It runs maintenance scripts from the $OBSIDIAN_WIKI_REPO directory and utilizes tools like find, sed, and bash to perform vault reconciliation and state management.
  • [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its processing of untrusted local data.
  • Ingestion points: Content is read from the user's Obsidian vault ($OBSIDIAN_VAULT_PATH) during both the index refresh and the hot.md regeneration steps.
  • Boundary markers: There are no explicit delimiters or instructions provided to the agent to ignore or isolate embedded instructions within the vault markdown files.
  • Capability inventory: The skill possesses significant capabilities, including writing to various vault files, modifying shell startup scripts (.zshrc), and installing system-level persistence agents (launchd).
  • Sanitization: No sanitization, validation, or filtering of the ingested vault content is performed before it is used to generate the semantic snapshot in hot.md.
Audit Metadata
Risk Level
MEDIUM
Analyzed
May 10, 2026, 02:25 PM