write-from-vault
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a bundled Python script (
scripts/export.py) during the Stage 5 export process. The script is deterministic, uses only the Python standard library, and is restricted to reading and writing within the user-configured vault path and the skill's own directory. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied research notes from a local vault. This creates a potential surface for indirect prompt injection if notes contain malicious instructions. However, the skill mitigates this risk through a multi-stage workflow (fragments, outline, beats) that requires model-driven extraction and human review between stages.
- [DATA_EXPOSURE]: The skill reads and writes research content within a local directory ("vault"). It includes explicit instructions to avoid scanning the entire disk and to ignore sensitive files such as
.envfiles or credentials. All operations are scoped to the user-defined knowledge vault path.
Audit Metadata