wiki-research

Warn

Audited by Gen Agent Trust Hub on Oct 13, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill is designed to invoke multiple external CLI tools, including yt-dlp, perplexity, defuddle, qmd, and obsidian-wiki. These tools are used for data retrieval, transcript extraction, and managing the Obsidian vault index.
  • [DYNAMIC_EXECUTION]: The skill implements a dynamic command execution engine via the research-backends.md configuration file. It reads YAML-defined command templates (e.g., perplexity search '{query}') and executes them by substituting placeholders at runtime. This allows the skill to run arbitrary binaries with user-defined flags based on local vault configuration.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from WebFetch and WebSearch and interpolates these values into shell command templates using the {url} and {query} placeholders.
  • Ingestion points: Data enters the system through WebFetch (retrieving web page content) and WebSearch (retrieving search results and URLs).
  • Boundary markers: No explicit boundary markers or 'ignore' instructions are used when processing the fetched content before synthesis or interpolation.
  • Capability inventory: The skill possesses the capability to execute shell commands (invoke), write to the local filesystem (Obsidian vault), and perform network operations.
  • Sanitization: The skill attempts to sanitize inputs by wrapping placeholders in single quotes (e.g., '{url}'), which provides some protection against basic shell injection but may not prevent all forms of argument injection or exploitation of the underlying binaries.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Oct 13, 2026, 10:30 AM