knowledge-ops
Pass
Audited by Gen Agent Trust Hub on Apr 14, 2026
Risk Level: SAFEPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it is designed to ingest and process untrusted data from various external sources.
- Ingestion points: Untrusted data enters the context through document ingestion, browser bookmarks, and conversation history exports (Claude, ChatGPT, Grok) as described in the 'Ingestion Workflow' and 'Sync Operations' sections of
SKILL.md. - Boundary markers: The skill lacks instructions to wrap ingested content in delimiters or to provide the agent with 'ignore embedded instructions' warnings when processing these materials.
- Capability inventory: The agent can write to sensitive local memory paths (
~/.claude/projects/*/memory/), modify a structured knowledge graph via MCP memory tools, and perform Git 'commit and push' operations to remote repositories. - Sanitization: While the skill correctly instructs the agent to 'Redact sensitive info (API keys, passwords)' before committing, there are no instructions to sanitize or validate the ingested content for malicious natural language instructions.
- [DATA_EXFILTRATION]: The skill moves data from local environments to external storage layers including Git repositories and third-party databases (Supabase, PostgreSQL). While this is the intended functionality, it involves handling sensitive information such as session exports and workspace directory maps. The inclusion of a redaction step for credentials in the 'Quality Gate' section is a positive security control that mitigates the risk of accidental secret exposure.
Audit Metadata