capture-knowledge
Warn
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill constructs and executes Python one-liners using the
python3 -cflag by interpolating shell variables like$VAULT_PATHdirectly into the script string. This creates a risk of command injection where malicious input could execute arbitrary code.- [COMMAND_EXECUTION]: The skill executes local shell utilities such asgrep,awk, and theobsidianCLI to perform vault discovery and file operations.- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes untrusted data from the user's project files and conversation history. - Ingestion points: Reads files from the current repository and conversation context (SKILL.md).
- Boundary markers: The instructions lack specific delimiters or instructions to ignore commands embedded in the processed text.
- Capability inventory: The skill has filesystem write access and the ability to execute local shell and Python commands (SKILL.md).
- Sanitization: No sanitization or validation of the distilled content is mentioned before it is written to the vault.
Audit Metadata