professional-brain
Pass
Audited by Gen Agent Trust Hub on Oct 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources (notes, artifacts) to maintain a local memory, which could lead to indirect prompt injection.\n
- Ingestion points: The 'ingest' operation in SKILL.md processes external artifacts and transcripts.\n
- Boundary markers: The skill uses provenance tags like [data] and [hunch] to categorize claims, which helps distinguish between different pieces of information.\n
- Capability inventory: The skill uses local scripts to read from and write to the filesystem.\n
- Sanitization: Filenames are slugged to prevent path traversal in scripts/brain_write.py, and all write operations require explicit user approval following a dry-run preview.\n- [DATA_EXFILTRATION]: The search utility contains a potential path traversal vulnerability.\n
- Evidence: In scripts/brain_query.py, the --section argument is joined to the root path without validation using os.path.join, which could allow the agent to read and search directories outside the intended brain folder.\n- [COMMAND_EXECUTION]: The skill utilizes local Python scripts for data management. These scripts are limited to the Python standard library and do not perform network operations. The write-back process is secured by a dry-run-first policy that requires user confirmation before committing changes.
Audit Metadata