learning-notes-automation
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill's instructions in SKILL.md and the logic in scripts/make_notes.py involve executing local Python scripts to perform data processing and file generation tasks.
- [DATA_EXFILTRATION]: The make_notes.py script performs network operations by sending data to the DeepSeek API (api.deepseek.com). This is the intended behavior for summarizing content through an LLM service and utilizes a well-known AI platform.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests transcripts from external platforms like YouTube and Bilibili, which presents an attack surface where malicious text in a transcript could influence the agent's behavior. \n
- Ingestion points: Transcription files provided as input to the make_notes.py script (referenced in SKILL.md). \n
- Boundary markers: The system prompt in make_notes.py defines the required JSON structure for the LLM output but lacks explicit delimiters (such as XML tags) or instructions to disregard potential commands found within the external content. \n
- Capability inventory: The skill possesses capabilities for shell command execution (SKILL.md), external network requests to DeepSeek (make_notes.py), and local file writing (make_notes.py). \n
- Sanitization: The script includes a sanitization function for file names using regex to prevent path manipulation and uses a helper function to validate JSON responses from the LLM.
Audit Metadata