cognitive-toolkit
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [PROMPT_INJECTION]: Indirect prompt injection surface detected. The skill ingests untrusted user input (automatic thoughts and situation descriptions) and processes it through a guided workflow without sanitization or boundary markers. These inputs are logged to the filesystem for longitudinal review, creating a potential path for persistent injection if the agent parses previous logs in later sessions.
- Ingestion points: User conversational input during CBT/DBT sessions and local genomic files via
references/health-integration.md. - Boundary markers: Absent; user-provided text is interpolated directly into prompts and session transcripts.
- Capability inventory: File writing (
~/Brains/brain/cognitive-toolkit/sessions/), file reading (~/Brains/genome/), and tool execution (mcp__health__*). - Sanitization: Absent; user responses are recorded verbatim into session markdown files.
- [EXTERNAL_DOWNLOADS]: The skill utilizes external Model Context Protocol (MCP) tools (
mcp__health__*) to fetch physiological vitals and activity summaries from Apple Health and Aurora Ring sources. - [COMMAND_EXECUTION]: Automated filesystem operations are performed to write structured session logs and therapeutic pattern analysis to hardcoded local directories (
~/Brains/brain/cognitive-toolkit/sessions/andcognitive-toolkit/patterns/). - [DATA_EXFILTRATION]: Accesses sensitive personal data, specifically pharmacogenomic markers (e.g., COMT, SLC6A4 variants), by reading local files from a designated 'Genome Vault' at
~/Brains/genome/. While processed locally for therapeutic context, this represents access to private health information.
Audit Metadata