content-research
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from transcript files and uses extracted claims to perform web searches. If a transcript contains malicious instructions, the agent may attempt to follow them during the research phase.
- Ingestion points: The skill reads a user-provided markdown transcript file as specified in the
inputssection. - Boundary markers: None. The preprocessing steps clean Obsidian syntax but do not include instructions to ignore embedded commands or delimit the data from the agent's instructions.
- Capability inventory: The agent is instructed to perform web searches and write a
research.mdfile to the local filesystem. - Sanitization: Preprocessing is limited to stripping YAML and converting links, with no escaping or validation of the transcript text before it is used for search queries or file generation.
- [DATA_EXFILTRATION]: The skill uses a hardcoded absolute file path targeting a specific user directory:
/Users/rami/Documents/life-os/notes-processing/. While this aligns with the author's name (rami-maalouf), hardcoding absolute paths to local user directories is a sensitive file path pattern that interacts with the host filesystem.
Audit Metadata