knowledge-base-add-project
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external upstream repositories (e.g., READMEs, API references, and release notes) to populate a knowledge base. This creates an attack surface where malicious instructions embedded in an upstream project could potentially influence the agent's actions.
- Ingestion points: Untrusted external repository content fetched during the "Add" and "Update" modes, specifically file contents like
README.md,api-reference.md, andreleases.md(SKILL.md). - Boundary markers: The skill explicitly instructs the agent to "link, don't copy" and "Summarize and link; do not copy upstream text wholesale," which serves as a natural delimiter against direct instruction mirroring.
- Capability inventory: The skill has access to shell tools (
git,gh,mermaid-render) and file system operations (Read,Write,Edit,Glob,Grep) within the~/code/knowledge-basedirectory. - Sanitization: The instructions rely on the agent's summarization capabilities to filter content rather than programmatic sanitization.
- [COMMAND_EXECUTION]: The skill utilizes shell commands to perform git operations, GitHub CLI actions, and Mermaid diagram rendering (
mermaid-render,mmdc). These commands are scoped to the knowledge-base repository but interact with content derived from external upstream sources.
Audit Metadata