brain
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from local markdown notes through the
brain searchandbrain graphcommands. These notes can contain hidden or explicit instructions that may influence the agent's behavior during subsequent processing steps. - Ingestion points: Contents of markdown files indexed and retrieved by the
brainCLI as seen inSKILL.md. - Boundary markers: Absent; the instructions do not provide delimiters or warnings to ignore instructions found within note content.
- Capability inventory: The agent can execute CLI commands via the
braintool and perform file operations such as adding or updating notes. - Sanitization: Absent; note contents are incorporated directly into the agent's context without filtering.
- [COMMAND_EXECUTION]: The skill is designed to execute shell commands using the
brainCLI tool. This creates a capability surface where untrusted input from notes could potentially influence command arguments or trigger unintended CLI actions.
Audit Metadata