publish-to-confluence
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill reads and converts arbitrary Markdown documents from the vault to publish them to an external Confluence instance, creating a potential surface for indirect prompt injection if the files contain malicious instructions.
- Ingestion points: Reads local Markdown text files from folders like
04-projects/,05-knowledge/, and01-daily/during Phase 1. - Boundary markers: Absent. There are no explicit boundaries or instructions defining the file contents as untrusted data to prevent the model from obeying embedded text commands.
- Capability inventory: Executes local system commands via Bash, reads and updates files in the vault, and makes network requests via WebFetch to the Confluence REST API.
- Sanitization: Translates Markdown structural tokens to XHTML formatting and strips YAML frontmatter metadata, but does not filter natural language content for injection payloads.
- [COMMAND_EXECUTION]: The skill runs a basic shell command (
date '+%Y-%m-%d %H:%M') via Bash to fetch the current time during the pre-flight check. This command is completely static and does not present any argument injection risks.
Audit Metadata