second-brain-fix
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from user notes and audit findings files to perform automated bulk updates, which could be exploited if those files contain malicious instructions.
- Ingestion points: The
$audit-resultsmarkdown file and all markdown files within the user-specified notes directory. - Capability inventory: Filesystem write access (modifying notes) and shell command execution via Git.
- Boundary markers: Uses specific markdown headers like
## Current Stateand## Logto delimit processed data. - Sanitization: Instructions emphasize verbatim copying and date-stamping, but there is no explicit sanitization of potentially malicious instructions embedded in the note text itself.
- [COMMAND_EXECUTION]: The skill uses shell commands to verify the environment and manage backups via Git.
- Evidence: The agent is instructed to run
git rev-parse --show-toplevel,git init,git add -A, andgit checkout -b second-brain-fix. - Safety markers: The skill includes explicit instructions to avoid network exposure, stating "Never add a remote and never push."
Audit Metadata