ai-personal-os-onboarding
Pass
Audited by Gen Agent Trust Hub on Jul 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
Bashtool to rununame -sanddate +%Z. These are benign commands used to automatically identify the user's operating system and timezone, which helps customize the generated configuration files. - [PROMPT_INJECTION]: The skill collects free-form text from the user regarding their role, goals, and preferences, and writes this data directly into files such as
CLAUDE.md. These files are intended to serve as persistent instructions for the AI agent in future sessions. This pattern creates a surface for indirect prompt injection if a user provides malicious instructions instead of the requested information. - Ingestion points: User responses provided during Phase 1 (Discovery), Phase 2 (Course Goals), and Phase 3 (Soul Configuration).
- Boundary markers: None identified; user input is interpolated directly into markdown templates without delimiters or warnings to ignore embedded instructions.
- Capability inventory: The skill has access to
AskUserQuestion,Write,Read,Edit,Glob, andBashtools. - Sanitization: There is no evidence of input validation or sanitization before user-provided text is committed to the persistent instruction files.
Audit Metadata