wiki-ingest
Pass
Audited by Gen Agent Trust Hub on May 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes local Python helper scripts using
subprocess.runinscripts/rebuild_context_brief.pyandscripts/convert_to_md.py. These calls use the list-based argument format and avoid shell-specific features.\n- [COMMAND_EXECUTION]: Thescripts/convert_to_md.pyscript shells out to an optional external utility,markitdown, to handle conversion of binary office formats (e.g., .docx, .pptx) to markdown.\n- [PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection due to the processing of untrusted data:\n - Ingestion points: Processes files from the
raw/directory, content fetched from arbitrary URLs, and user-provided text pastes (documented inSKILL.mdSteps 2 and 2a).\n - Boundary markers: While it uses templates with placeholders (defined in
references/templates/), there are no strict adversarial boundary markers to prevent malicious instructions in the source content from influencing the agent's behavior during page generation.\n - Capability inventory: Possesses capabilities to write to the file system (via
atomic_writeinscripts/_wikilib.py), update configuration files (scripts/config_bump.py), and execute local scripts.\n - Sanitization: Implements regex-based slug sanitization (
SLUG_CLEAN_REinscripts/batch_builder.py), but lacks robust filtering for instructions embedded within the source documents themselves.
Audit Metadata