second-brain-audit
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a bundled Python script (
scripts/audit.py) to perform the statistical analysis of the notes. The script uses standard libraries (argparse, re, pathlib) and performs read-only operations on the user-specified directory. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process content from user-controlled notes and 'agent memory' files, which constitutes a potential attack surface if the notes contain malicious instructions.
- Ingestion points: User notes in markdown format and system files like
CLAUDE.mdorMEMORY.mdare loaded into the agent's context. - Boundary markers: The skill uses logic-based sorting (State vs. Event) but does not employ explicit delimiters like XML tags for the ingested content.
- Capability inventory: The skill has the capability to read files via the audit script and the capability to write to the file system when the agent is instructed to 'Fix one place'.
- Sanitization: No explicit sanitization or filtering of the note content is performed before processing.
Audit Metadata