anki-connect
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to use system tools such as
curlandjqto send and receive data from the AnkiConnect HTTP API hosted athttp://127.0.0.1:8765. This involves executing shell commands to perform both read and write operations on the local filesystem via the Anki service. - [INDIRECT_PROMPT_INJECTION]: The skill processes data stored in Anki (notes, cards, and media) which is considered untrusted external input that could contain malicious instructions designed to manipulate the agent's behavior.
- Ingestion points: Data enters the agent context through actions such as
notesInfo,cardsInfo,findNotes, andretrieveMediaFile(referenced in SKILL.md). - Boundary markers: The instructions do not specify the use of delimiters or 'ignore' instructions to separate retrieved flashcard content from the agent's system instructions.
- Capability inventory: The skill provides access to a wide range of modifying actions, including
deleteNotes,deleteDecks,updateNoteFields, andsync(defined in the Action Catalog). - Sanitization: There is no evidence of sanitization, filtering, or validation of the content retrieved from Anki before the agent interprets it.
Audit Metadata