anki-connect
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on the execution of shell commands, specifically
curlandjq, to communicate with the AnkiConnect API athttp://127.0.0.1:8765. It provides templates for constructing JSON requests and parsing responses to manage decks, notes, and cards. - [PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection because it reads and processes user-controlled data from Anki notes.
- Ingestion points: Data retrieved from Anki via actions like
notesInfo,cardsInfo, andfindNotesas described inSKILL.md. - Boundary markers: The skill does not define specific delimiters or instructions to prevent the agent from obeying instructions embedded within the flashcard content.
- Capability inventory: The agent can perform network requests to the local API and modify or delete local flashcard data.
- Sanitization: While the skill provides patterns for checking API errors, it does not include instructions for sanitizing or escaping the content retrieved from the notes themselves.
Audit Metadata