wiki-self-heal
Pass
Audited by Gen Agent Trust Hub on Apr 13, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [PROMPT_INJECTION]: The skill implements an 'Autonomy rule' and a 'NEVER STOP' directive that instructs the agent to bypass standard human-in-the-loop checkpoints and persist in its execution loop without pausing for user confirmation. This behavior is intended for autonomous operation but intentionally reduces user oversight.
- [EXTERNAL_DOWNLOADS]: The skill fetches content from external web sources via research tools like Exa, Firecrawl, and Apify. Ingesting untrusted external data into the agent's context presents a surface for indirect prompt injection, where malicious instructions embedded in web pages could influence agent behavior.
- [COMMAND_EXECUTION]: The skill uses local shell commands (grep, find, wc) to audit the wiki and Git commands to manage branch state and commit changes.
- [DATA_EXFILTRATION]: Local wiki content, including topics and concept names, is transmitted to external search engines and research APIs during the automated data gathering phase.
- [PROMPT_INJECTION]: Indirect Prompt Injection Surface: 1. Ingestion points: Local wiki files and external web research results (found in SKILL.md and loop.md). 2. Boundary markers: No explicit delimiters or instructions are used to isolate ingested untrusted data from the agent's command context. 3. Capability inventory: Access to shell execution, Git repository management, and network research tools (found in loop.md and audit.md). 4. Sanitization: While research quality gates are mentioned to ensure factual accuracy, there is no technical sanitization to prevent adversarial instructions within the data from being executed by the agent.
Audit Metadata