lokf-sidecar
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill implements a librarian automation (knowledge-librarian.sh) designed to run a coding agent over the repository content. \n
- Ingestion points: The coding agent, configured via the AGENT_CLI variable, reads the entire repository in the refresh job of the knowledge-librarian workflow. \n
- Boundary markers: The automation uses a structured prompt that instructs the agent to follow specific skill files and limit modifications to the .lokf/knowledge/ directory. \n
- Capability inventory: The agent, acting as a coding assistant, has the capability to write files and execute commands; the wrapper script attempts to enforce a restricted write-scope by checking git status for stray modifications after execution. \n
- Sanitization: Repository content is not explicitly sanitized before being processed by the librarian agent, relying instead on the agent's internal guardrails and the wrapper's filesystem checks. \n
- [EXTERNAL_DOWNLOADS]: The knowledge-librarian.yaml GitHub Action fetches the lokf-librarian skill from the author's public GitHub repository (noelmcloughlin/knowledge-trust-ladder) during the scheduled maintenance cycle. \n
- [COMMAND_EXECUTION]: The skill executes multiple utility scripts (knowledge-preflight.sh, knowledge-librarian.sh, knowledge-conventions.sh) using bash and uses python3 for performing placeholder substitution within the scaffolded templates.
Audit Metadata