vault-health
Warn
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: MEDIUMCREDENTIALS_UNSAFEPERSISTENCECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONTIME_DELAYED_CONDITIONAL
Full Analysis
- [CREDENTIALS_UNSAFE]: Accesses sensitive configuration files (~/.vault-automation.env) to verify the presence and validity of Notion API tokens as part of the health check diagnostic process.
- [PERSISTENCE]: Manages and interacts with system-level persistence mechanisms via launchctl to handle automated daily vault tasks and health reports, which includes loading and unloading launch agents.
- [COMMAND_EXECUTION]: Executes local automation scripts (node ... vault-automation.js) and various system commands including find, grep, tail, curl, and launchctl for status checks and troubleshooting.
- [INDIRECT_PROMPT_INJECTION]: Ingests data from potentially untrusted sources including auto-generated health reports, other skills' metadata (~/.claude/skills/*/SKILL.md), and configuration files (config.json). Ingestion points: system/health-report.md, config.json, and the SKILL.md files of other installed extensions. Boundary markers: None explicitly defined to distinguish between processed diagnostic data and instructional content. Capability inventory: Spawns subprocesses for node, launchctl, find, and curl. Sanitization: No clear evidence of validation or sanitization for the content read from external health reports or skill metadata before processing and reporting.
- [TIME_DELAYED_CONDITIONAL]: Includes logic for automated proactive triggers, specifically a monthly skills audit scheduled to execute on the 1st of each month.
Audit Metadata