second-brain-audit
Pass
Audited by Gen Agent Trust Hub on Aug 7, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Python script (
scripts/audit.py) to process note files. The script uses standard libraries to perform text analysis and reports its findings in either plain text or JSON format. The script itself is limited to read-only operations and does not execute arbitrary shell commands. - [PROMPT_INJECTION]: The skill possesses an Indirect Prompt Injection surface because it instructs the agent to read and process arbitrary user-controlled content from notes, vaults, or wikis. If these files contain malicious instructions, the agent may follow them during the audit process.
- Ingestion points: The agent reads the 'always-loaded surface' (e.g.,
CLAUDE.md,MEMORY.md) and other markdown files in a user-provided directory as described inSKILL.md(Phases 2 and 4) and performed byaudit.py. - Boundary markers: Absent. The instructions do not specify using delimiters or explicit warnings to ignore instructions embedded within the notes.
- Capability inventory: The agent has the capability to execute shell commands (to run the audit script) and write to the local filesystem to 'fix' notes (Phase 6).
- Sanitization: Absent. The skill does not provide mechanisms to filter or escape instructions found within the audited content.
Audit Metadata