wiki-grow

Fail

Audited by Gen Agent Trust Hub on Aug 24, 2026

Risk Level: HIGHCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [PERSISTENCE_MECHANISMS]: The skill documentation describes a persistence mechanism using a macOS LaunchAgent located at ~/Library/LaunchAgents/com.example.weekly-wiki-grow.plist and a scheduled cron job (Saturday at 06:45) to automatically execute local scripts across sessions.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from project documentation and atlas topics to generate new wiki entries, creating a surface for indirect prompt injection.
  • Ingestion points: The scripts/wiki-promote-scan.py script walks project knowledge folders (<project>/knowledge/), atlas topics, and book prose.
  • Boundary markers: The skill generates YAML frontmatter and an 'auto-promoted draft' banner but does not utilize delimiters to isolate ingested content or instruct the agent to ignore embedded instructions.
  • Capability inventory: The skill has access to the Bash and Read tools and performs file-write operations to the ~/vault/concepts/ directory.
  • Sanitization: No sanitization or escaping of natural language content is described; the orchestrator only performs wikilink resolution.
  • [COMMAND_EXECUTION]: The skill is designed to execute local shell scripts (scripts/weekly-wiki-grow.sh) and Python scripts (scripts/wiki-grow.py) using the uv tool, which allows for the execution of arbitrary commands within the user's environment.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Aug 24, 2026, 06:17 AM
Security Audit — agent-trust-hub — wiki-grow