ingest-codebase
Fail
Audited by Gen Agent Trust Hub on Jun 20, 2026
Risk Level: HIGHDATA_EXFILTRATIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill explicitly instructs agents to locate and read sensitive configuration files, specifically referencing .env files which often contain secrets and credentials.
- Evidence: Phase 1, Agent 3 instructions state: "Find configuration files (.config., .env*, etc.). What can be configured?"
- [COMMAND_EXECUTION]: The skill uses the 'mental' CLI tool to execute various commands for managing the system model, representing a direct use of shell capabilities.
- Evidence: Multiple shell snippets in Phase 3 and the Quick Reference section demonstrate usage of 'mental add', 'mental update', and 'mental delete'.
- [PROMPT_INJECTION]: The skill provides an indirect prompt injection surface by ingesting untrusted content from external codebases and using that information to drive modeling actions.
- Ingestion points: The entire codebase including READMEs, source files, and configuration files (Phase 1 and Phase 2).
- Boundary markers: Absent; there are no instructions for the agent to distinguish between data and instructions when reading files.
- Capability inventory: Shell command execution via the 'mental' CLI tool.
- Sanitization: Absent; the skill does not include steps to sanitize or validate content discovered in the codebase before processing it.
Recommendations
- AI detected serious security threats
Audit Metadata