dbs-content-system
Pass
Audited by Gen Agent Trust Hub on Jul 27, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: Indirect Prompt Injection Surface. The skill ingests and processes untrusted local content assets (e.g., articles, tweets, and transcripts in the '01-原始素材区/完整副本/' directory) to extract content units and generate summaries. This creates a potential surface where malicious instructions embedded in source documents could influence the agent's behavior during the content structuring phase.
- Ingestion points: Local markdown and text files located in the '01-原始素材区/完整副本/' directory, processed by scripts like 'extract-sample-units.js'.
- Boundary markers: The system uses standard YAML frontmatter and Markdown headers to delimit fields, but there are no explicit 'ignore embedded instructions' warnings or strict delimiters used to prevent the LLM from following instructions within the processed text.
- Capability inventory: The skill contains scripts that perform file system write operations ('fs.writeFileSync') and requires the agent to execute local Node.js scripts for project management.
- Sanitization: Content extraction relies on regular expressions and string manipulation ('stripMarkdown', 'cleanSentence') without semantic sanitization to prevent the interpretation of natural language instructions contained within the data.
- [COMMAND_EXECUTION]: Local Script Execution. The skill provides and instructs the agent to run multiple local Node.js utility scripts (e.g., 'extract-sample-units.js', 'generate-link-map.js', 'fill-obsidian-links.js') to initialize projects and process content. These scripts are provided within the skill package and perform legitimate file management and text processing tasks relative to the project root.
Audit Metadata