knowledge-ops
Pass
Audited by Gen Agent Trust Hub on Jul 29, 2026
Risk Level: SAFEDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill accesses sensitive local directories located at
~/.gemini/egc-projects/*/memory/to manage project context and user preferences. While this is the intended purpose of the skill, it involves reading from a directory that may contain private user information. - [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection attack surface (Category 8) due to the ingestion and processing of data from potentially untrusted external sources.
- Ingestion points: Ingests data from GitHub issues, pull requests, browser bookmarks, and external documents stored in Supabase or PostgreSQL (SKILL.md).
- Boundary markers: The skill suggests using YAML frontmatter for metadata but does not define explicit delimiters or isolation instructions to prevent the agent from following commands embedded within the ingested data.
- Capability inventory: The skill uses tools to write to local files, commit/push to Git repositories, modify MCP memory graphs (
create_entities,create_relations), and interact with external database layers. - Sanitization: The skill explicitly includes a best practice to redact sensitive information like API keys and passwords before committing data to Git, which serves as a manual sanitization step.
Audit Metadata