karpathy-llm-wiki
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest untrusted data from external sources and synthesize it into wiki articles. This process exposes the agent to indirect prompt injection risks.
- Ingestion points: The Ingest operation in SKILL.md fetches content from arbitrary external sources to be processed.
- Boundary markers: The skill uses markdown headers, blockquotes, and YAML frontmatter to structure data, but lacks explicit 'ignore embedded instructions' warnings when processing raw text in the article generation pipeline.
- Capability inventory: The skill allows the agent to read from and write to the local filesystem (raw/ and wiki/ directories) and perform network requests to retrieve source material.
- Sanitization: Instructions suggest cleaning formatting noise but do not specify robust sanitization or validation of the content's intent, potentially allowing malicious instructions in the source to influence the agent.
- [EXTERNAL_DOWNLOADS]: The Ingest tool allows the agent to fetch content from user-specified URLs or files using environment-provided tools such as curl or wget. While intended for knowledge gathering, this involves outbound network activity to unverified domains.
Audit Metadata