knowledge-base
Pass
Audited by Gen Agent Trust Hub on Jun 28, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill exhibits a vulnerability surface for indirect prompt injection due to its autonomous persistence model.
- Ingestion points: The agent reads markdown files (notes, MOCs, and
INDEX.md) from a user-defined directory at the start of conversations. - Boundary markers: There are no defined delimiters or instructions provided to the agent to treat wiki content as untrusted or to ignore embedded instructions within the notes.
- Capability inventory: The skill allows the agent to read files, write/update files, and execute
grepcommands across the knowledge base directory. - Sanitization: While the instructions explicitly forbid logging secrets (API keys, passwords) and PII, there is no requirement to sanitize or escape natural language content to prevent the agent from following instructions embedded in stored data.
- Concealment Patterns: The instructions tell the agent to "not narrate" its reads/writes and to act "without asking for permission," which reduces user oversight and could allow malicious instructions to persist and influence future sessions silently.
Audit Metadata