kimu-learning-coach
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external content such as user-provided book text, notes, and previous progress records, which creates a surface for potential indirect prompt injection attacks.\n
- Ingestion points: Instructions in
SKILL.mdspecify that the agent should read book content, excerpts, and progress state fromkimu-learning-progress.md.\n - Boundary markers: The skill uses structural headers for output (e.g., "作者主张：", "教练解释：") to differentiate book content from agent analysis, though it lacks explicit instructions for the agent to ignore hidden commands within the ingested materials.\n
- Capability inventory: The skill includes the ability to write state to a specific file (
kimu-learning-progress.md) within the user-specified directory, which is a legitimate feature for persistence.\n - Sanitization: There is no documentation of input sanitization for the materials provided by the user.
Audit Metadata