ktx-ai-data-context-layer
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes several TypeScript utility scripts that use
child_process.execSyncto interact with thektxCLI tool for project initialization, automated data ingestion, and context searching. - [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest external data—including wiki content, dbt models, Notion pages, and database metadata—to provide context for AI agents. This creates a surface for indirect prompt injection if the ingested sources contain malicious instructions designed to influence the agent.
- Ingestion points: Data is gathered via the
ktx ingestcommand from various sources specified in thektx.yamlconfiguration, including local markdown files and external third-party APIs like Notion and Metabase. - Boundary markers: The current documentation and configuration do not specify the use of delimiters or explicit 'ignore' instructions when presenting search results to the agent's context.
- Capability inventory: The skill environment allows for command execution via local scripts and provides extensive tools for detailed schema and metric inspection.
- Sanitization: There is no evidence of content sanitization or filtering logic designed to prevent the agent from executing instructions embedded within the ingested data.
Audit Metadata