wiki-research
Warn
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill is designed to invoke multiple external CLI tools, including
yt-dlp,perplexity,defuddle,qmd, andobsidian-wiki. These tools are used for data retrieval, transcript extraction, and managing the Obsidian vault index. - [DYNAMIC_EXECUTION]: The skill implements a dynamic command execution engine via the
research-backends.mdconfiguration file. It reads YAML-defined command templates (e.g.,perplexity search '{query}') and executes them by substituting placeholders at runtime. This allows the skill to run arbitrary binaries with user-defined flags based on local vault configuration. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from
WebFetchandWebSearchand interpolates these values into shell command templates using the{url}and{query}placeholders. - Ingestion points: Data enters the system through
WebFetch(retrieving web page content) andWebSearch(retrieving search results and URLs). - Boundary markers: No explicit boundary markers or 'ignore' instructions are used when processing the fetched content before synthesis or interpolation.
- Capability inventory: The skill possesses the capability to execute shell commands (
invoke), write to the local filesystem (Obsidian vault), and perform network operations. - Sanitization: The skill attempts to sanitize inputs by wrapping placeholders in single quotes (e.g.,
'{url}'), which provides some protection against basic shell injection but may not prevent all forms of argument injection or exploitation of the underlying binaries.
Audit Metadata