ktx-ai-data-context-layer
Warn
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The example script
scripts/search-context.tsuseschild_process.execSyncto execute shell commands with string interpolation:execSync(`ktx sl "${query}" --json`, ...). This pattern is vulnerable to command injection if thequeryvariable contains shell metacharacters (e.g.,;,&,|), allowing arbitrary command execution on the host machine. - [EXTERNAL_DOWNLOADS]: The skill instructions direct users to install the
@kaelio/ktxpackage from the NPM registry and suggest usingnpx skills add Kaelio/ktxto download additional skill components. - [PROMPT_INJECTION]: The skill implements an architecture where AI agents process ingested wiki content and database metadata, creating an indirect prompt injection surface.
- Ingestion points: The
ktx ingestcommand reads markdown files from thewiki/directory and captures metadata/schema information from connected databases. - Boundary markers: The skill does not define or instruct the agent to use explicit boundary markers or delimiters when processing ingested content.
- Capability inventory: The skill provides file system access (writing YAML metrics), database read access, and execution of shell commands via the ktx CLI.
- Sanitization: There is no evidence of sanitization, filtering, or validation of the content ingested from wiki pages or database sources before it is provided to the agent.
Audit Metadata