waku-agent-assistant
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill directs the user to clone a source repository from https://github.com/ShenSeanChen/waku-agent and install the waku-agent package from a public registry.\n- [REMOTE_CODE_EXECUTION]: The setup process includes executing downloaded scripts and installing packages from external third-party sources as part of the tool's intended deployment.\n- [INDIRECT_PROMPT_INJECTION]: The agent's reasoning loop integrates information from web searches and long-term memory, creating a potential path for indirect prompt injection if external content contains malicious instructions.\n
- Ingestion points: Web search tool outputs and retrieved SQLite memory entries (facts and episodes) described in
waku/memory/andwaku/tools/.\n - Boundary markers: The documentation does not indicate the use of specific delimiters or safety instructions to prevent the agent from following instructions embedded in retrieved data during the reasoning loop in
waku/loop/agent.py.\n - Capability inventory: The agent has access to a local database (
.waku/state.db), calendar tools, and the ability to execute custom Python code registered via the@tooldecorator.\n - Sanitization: No explicit validation or filtering logic for external content is described in the provided architectural components.
Audit Metadata