skills/frankieramirez/mana/mimic/Gen Agent Trust Hub

mimic

Warn

Audited by Gen Agent Trust Hub on Sep 30, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides specific shell commands to be executed by the agent to mine data from the local environment and external APIs. For example, references/ghost.md provides a complex command to parse local application logs: grep -h '"type":"user"' -- ~/.claude/projects/*/*.jsonl | grep '"promptSource":"typed"' | sed -E 's/.*"content":"((\\.|[^"\\])*)".*/\1/'. It also utilizes gh api and git config to extract user identity and communication history.
  • [DATA_EXFILTRATION]: The skill accesses and processes sensitive user data, including local AI interaction logs (~/.claude/projects/*.jsonl), persistent profile files (~/.mimic.md), and private communication via GitHub and Slack connectors. This information is distilled and stored in a persistent voice profile on the user's filesystem.
  • [INDIRECT_PROMPT_INJECTION]: The skill has a large attack surface for indirect prompt injection as it ingests untrusted data from external sources.
  • Ingestion points: Reads content from ~/.claude/projects/*.jsonl, GitHub PR comments, issue descriptions, and git commit history via the ghost subagent.
  • Boundary markers: The instructions include logic to 'scrub' data and 'drop' items containing secrets, credentials, or bot-generated text, though these are instructional and not enforced by the platform.
  • Capability inventory: The skill can execute shell commands (grep, sed, gh), write to the filesystem (~/.mimic.md), and spawn subagents.
  • Sanitization: There are explicit instructions for the agent to filter out tokens, passwords, and client names before including snippets in the voice profile.
  • [DYNAMIC_EXECUTION]: The skill employs a subagent architecture, spawning a 'Ghost' agent with instructions dynamically loaded from a reference file (references/ghost.md) to perform data distillation tasks.
  • [PROMPT_INJECTION]: The Persona at invocation block in SKILL.md provides instructions to override the agent's default voice and behavior with an 'Archmage' persona. This involves loading external instruction files (references/archmage.md) that dictate specific character rhythmic patterns and interaction styles.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Sep 30, 2026, 01:57 PM