mo-book-creator
Pass
Audited by Gen Agent Trust Hub on Apr 7, 2026
Risk Level: SAFEDATA_EXFILTRATIONCOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by processing arbitrary external text to generate instructions for other AI agents.
- Ingestion points: Ingests data from user-provided PDF file paths, remote URLs, and raw text inputs as described in Phase 1 of
SKILL.md. - Boundary markers: The chapter extraction prompts in
references/pipeline.mdlack explicit delimiters or instructions to ignore embedded commands within the book content. - Capability inventory: The skill has the capability to write files to the filesystem and execute shell commands (
git push,cp) to interact with the local environment and remote repositories. - Sanitization: No sanitization or validation logic is present to filter malicious instructions within the source documents before they are synthesized into new skills.
- [DATA_EXFILTRATION]: The skill automatically stages and pushes generated skill summaries to an external Git repository (
itsAR-VR/goatedskills) on GitHub. While targeting a recognized service, this behavior results in the external exposure of data derived from local documents or provided URLs. - [COMMAND_EXECUTION]: Executes shell commands to install generated skills into the local environment (
~/.openclaw/skills/) and perform Git version control operations, including identity configuration and remote pushing. - [EXTERNAL_DOWNLOADS]: The skill includes functionality to fetch and process content from arbitrary remote URLs provided by the user during the intake phase.
Audit Metadata