sense
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process and summarize content from a markdown 'tree' (directory). These files are treated as untrusted external data and may contain embedded instructions meant to influence the agent's behavior.
- Ingestion points: Content is ingested from any markdown file within the directory configured for indexing (SKILL.md, search.md).
- Boundary markers: The tool returns specific line ranges (e.g., 'L12-28') and snippets, which scopes the data, but it does not provide an explicit mechanism to ignore embedded instructions (terminology.md).
- Capability inventory: The agent can execute shell commands via the 'sense' CLI and read any file within the directory (SKILL.md).
- Sanitization: No sanitization of the markdown prose or frontmatter values is mentioned before the agent processes the retrieved text.
- [COMMAND_EXECUTION]: The core functionality of the skill relies on executing the 'sense' CLI with various subcommands (status, map, sql, search, peek, path, related, build, watch) to interact with the indexed data.
- [EXTERNAL_DOWNLOADS]: The documentation instructs users to install the primary 'sensemaking' tool via the NPM registry. Additionally, the DuckDB and Turso storage adapters may automatically install their respective native API packages (@duckdb/node-api, @tursodatabase/database) upon first use (sqlite.md, duckdb.md, turso.md).
Audit Metadata