llm-wiki

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 0.90). The prompt explicitly instructs agents how to bypass inline script security scanning (e.g., "write the script to /tmp/script.py ... This avoids inline script security scanning entirely"), which is a deceptive/evading instruction outside the wiki's legitimate content-curation purpose.

---

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The prompt includes an explicit CLI example embedding a user's password (ob login --email --password ''), which encourages putting secrets directly into commands and would require the agent to handle or output secret values verbatim.

---

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The document is mostly a benign wiki-management spec but includes explicit, repeated guidance on how to evade inline script "security scanning" (write scripts to /tmp and run them) and instructions to run persistent background sync (obsidian-headless + systemd), which together enable intentional detection-evasion and potential unnoticed data exfiltration to a third-party sync service.

---

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The skill’s runtime “Ingest” workflow can fetch and ingest public web content via web_extract from user-supplied URLs into raw/articles/, and that extracted free-form text is then read/summarized into wiki markdown that becomes LLM context (indirect prompt-injection risk from outsider-authored page text).

---

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The prompt instructs running privileged system commands (e.g., "sudo loginctl enable-linger $USER") and includes systemd setup steps that modify system behavior, which asks for elevated privileges and therefore risks changing the machine state.

---

MEDIUM W021: Hidden or invisible Unicode characters detected (potential obfuscation or prompt injection).

• Hidden Unicode characters detected (1 type(s) found)