private-context-bootstrap
Pass
Audited by Gen Agent Trust Hub on May 28, 2026
Risk Level: SAFEDATA_EXFILTRATIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill's primary function is to handle and materialize sensitive user context, including personal profiles, employment records, and identity documents (PDFs). It targets sensitive local directories such as
~/.config/AgentDesk/privateand~/.local/share/AgentDesk/private-repo. - [EXTERNAL_DOWNLOADS]: The bootstrap workflow requires cloning or syncing data from remote sources defined by the
AGENTDESK_PRIVATE_REMOTEenvironment variable, as well as downloading PDF documents from remote storage. - [COMMAND_EXECUTION]: The instructions explicitly direct the agent to run an external script,
scripts/bootstrap-private-context.sh, referenced as part of the OpportunityOS repository. - [PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection by processing data from remote sources.
- Ingestion points: The agent reads and processes
application-profile.yaml,document-manifest.yaml,field-answer-policy.yaml,personal-profile.yaml, andapplication-log.jsonl(referenced inSKILL.md). - Boundary markers: No explicit boundary markers or instructions are provided to the agent to ignore embedded commands within the ingested data files.
- Capability inventory: The skill has capabilities for file system access, network operations (git clone/sync), executing decryption tools (
age,sops), and running thebootstrap-private-context.shscript. - Sanitization: The skill recommends schema validation but does not specify protection against natural language instruction injection within those schemas.
Audit Metadata