letter-hooker
Pass
Audited by Gen Agent Trust Hub on Nov 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a Python script (scripts/agy_kontext_and_workflow_loader.py) to manage agent configurations, which is the primary intended functionality for prompt governance and maintenance.
- [INDIRECT_PROMPT_INJECTION]: The skill maintains an indirect prompt injection surface by reading external task logs and sidecar data to modify future agent prompts.
- Ingestion points: Sidecar JSON files (sidecar.json), automation logs (ANTIGRAVITY-LOG.txt), and memory files (AUTOMATIONS-MEMORY.md).
- Boundary markers: The script uses the delimiter '--- GOVERNANCE, WORKFLOW & HOOKS ---' to separate injected governance instructions from original prompt content.
- Capability inventory: The script performs file read and write operations within the agent's configuration directories (~/.gemini/) and configured sync paths.
- Sanitization: The script performs keyword extraction via regex but does not deeply sanitize the content of the logs before interpolation into prompt footers.
- [DATA_EXFILTRATION]: The script moves task keywords and metadata from local agent directories to a user-defined synchronization folder (defaulting to ~/OneDrive/.SYNC), which is consistent with its stated purpose of cross-device task synchronization using well-known cloud services.
Audit Metadata