wiki-grow
Fail
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: HIGHCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [PERSISTENCE_MECHANISMS]: The skill documentation describes a persistence mechanism using a macOS LaunchAgent located at
~/Library/LaunchAgents/com.example.weekly-wiki-grow.plistand a scheduled cron job (Saturday at 06:45) to automatically execute local scripts across sessions. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from project documentation and atlas topics to generate new wiki entries, creating a surface for indirect prompt injection.
- Ingestion points: The
scripts/wiki-promote-scan.pyscript walks project knowledge folders (<project>/knowledge/), atlas topics, and book prose. - Boundary markers: The skill generates YAML frontmatter and an 'auto-promoted draft' banner but does not utilize delimiters to isolate ingested content or instruct the agent to ignore embedded instructions.
- Capability inventory: The skill has access to the
BashandReadtools and performs file-write operations to the~/vault/concepts/directory. - Sanitization: No sanitization or escaping of natural language content is described; the orchestrator only performs wikilink resolution.
- [COMMAND_EXECUTION]: The skill is designed to execute local shell scripts (
scripts/weekly-wiki-grow.sh) and Python scripts (scripts/wiki-grow.py) using theuvtool, which allows for the execution of arbitrary commands within the user's environment.
Recommendations
- AI detected serious security threats
Audit Metadata