research-note
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input ("rough questions") to generate file content, filenames, and search queries.
- Ingestion points: User-provided questions and motivating context are ingested as the primary source for note creation in
SKILL.md(Steps 1, 4, 8). - Boundary markers: There are no explicit delimiters or boundary markers used to separate user-provided data from the skill's operational instructions.
- Capability inventory: The skill has the capability to rename files (
mv,git mv), write new files, delete source files, and commit changes to a git repository. - Sanitization: No input sanitization or validation is performed on the user's question before it is used to determine filenames or file content.
- [COMMAND_EXECUTION]: The skill instructs the agent to use shell commands for file management and version control, intentionally bypassing user oversight.
- Evidence: Step 9 explicitly states "Do not prompt the user before deleting" when splitting notes.
- Evidence: Step 10 and Step 11 instruct the agent to "Commit each file to git immediately" and "never ask whether to update the note", explicitly stating "Do not prompt the user before committing."
- This pattern of autonomous execution without human-in-the-loop confirmation increases the risk of accidental or malicious file operations.
Audit Metadata