karpathy-llm-wiki
Pass
Audited by Gen Agent Trust Hub on Apr 13, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted data from external sources and integrates it into a persistent knowledge base. \n
- Ingestion points: External content is fetched from URLs or user-pasted text during the
Fetch (raw/)step inSKILL.md.\n - Boundary markers: The instructions do not define boundary markers or warnings for the agent to ignore embedded instructions in the source material.\n
- Capability inventory: The skill allows the agent to read and write files within the project's
raw/andwiki/directories and perform network requests to fetch data.\n - Sanitization: There is no explicit requirement for the agent to sanitize or escape the external content before synthesizing it into wiki articles.\n- [EXTERNAL_DOWNLOADS]: The skill fetches source material from arbitrary external URLs to populate the knowledge base, which is an intended core function but represents an interaction with untrusted external content.\n- [COMMAND_EXECUTION]: The skill performs automated file system operations, including directory creation and file modification (auto-fixing links and index entries) during the
IngestandLintoperations.
Audit Metadata