resolve-recipe-ingredient-link
Warn
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute a shell command using a local binary located at
/Users/mtm/go/bin/islandiguanato list files. This represents direct shell interaction within a hardcoded environment.\n- [EXTERNAL_DOWNLOADS]: The test documentation referencespnpm dlx promptfoo. While this involves an external tool download,promptfoois a well-known service for LLM evaluation and is considered a safe development tool for testing purposes.\n- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection via user-supplied wikilinks in recipe notes.\n - Ingestion points: Ingredient lines containing wikilinks are read from source notes provided by the user.\n
- Boundary markers: No explicit delimiters or instructions are provided to the agent to isolate the link text from potentially malicious surrounding content.\n
- Capability inventory: The agent can execute shell commands and write new Markdown files to the local file system.\n
- Sanitization: The instructions lack any validation or sanitization logic for the extracted link text before using it as a filename. This could be leveraged to attempt path traversal (e.g.,
[[../sensitive_file]]) when the agent creates new files in the vault.
Audit Metadata