subject-learning-assistant
Pass
Audited by Gen Agent Trust Hub on May 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [PROMPT_INJECTION]: The skill ingests user-provided text (papers, web content) into a long-term memory system (memocli). This creates a surface for indirect prompt injection where malicious instructions embedded in the source material could influence the agent's behavior during the pedagogical interaction phase.
- Ingestion points: Text extraction and entity creation in 'Sub-process 1: Content Ingestion' within SKILL.md.
- Boundary markers: None defined to isolate external data from instructions in memory commands.
- Capability inventory: Graph-based memory modification, interactive teaching, and local server execution.
- Sanitization: The server.py script does not sanitize data read from the knowledge base, and the dashboard (index.html) renders this data directly using '.html()', creating a cross-site scripting (XSS) vulnerability if the ingested content contains malicious HTML/JS tags.
- [COMMAND_EXECUTION]: The skill instructs the agent to provide a command for the user to manually run a local Python visualization server ('server.py'). While this execution is transparent and user-initiated, the script handles local file access to the knowledge base directory.
- [EXTERNAL_DOWNLOADS]: The visualization dashboard (index.html) loads the D3.js library from the 'd3js.org' CDN. This is a well-known and trusted service for data visualization.
- [DATA_EXFILTRATION]: The server.py script initializes a TCPServer listening on all network interfaces ('') by default. If the user runs the script on an unprotected network, the contents of the pedagogical knowledge base could be accessible to other devices on the same network via the specified port.
Audit Metadata