anc-bible
Pass
Audited by Gen Agent Trust Hub on Jun 20, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill documents the processing of untrusted external data (Excel spreadsheets and RFP PDF files).
- Ingestion points: Documented in
Step1Ingestion.tsx(Excel upload) andrfpExtractor.ts(PDF extraction). - Boundary markers: The documentation does not specify boundary markers or explicit sanitization instructions for handling these untrusted inputs in the prompt flow.
- Capability inventory: The system has capabilities to write to a PostgreSQL database via Prisma, generate PDFs via a headless Chrome service (Browserless), and execute form actions via
actionExecutor.ts. - Sanitization: Not explicitly documented in the provided bible content.
- [UNVERIFIABLE_DEPENDENCIES_REMOTE_CODE_EXECUTION]: The skill references external services and official repositories for deployment and AI functionality.
- References the author's own GitHub repository
khaledbashir/rag2for source code. - Interacts with
AnythingLLMandBrowserlessservices for RAG and PDF rendering. - Utilizes
Puter.jsfor client-side vision processing via Kimi K2.5. - These references target the author's own infrastructure or well-known services, which is consistent with standard development practices.
- [DATA_EXPOSURE_EXFILTRATION]: The skill contains internal infrastructure metadata for the project.
- Lists the production VPS IP address:
138.201.126.110. - Lists specific production hostnames on the
easypanel.hostdomain. - These represent the vendor's own infrastructure and are documented for project context.
Audit Metadata