wiki-room
Warn
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a shell command
python3 harness/scripts/mem-rank.py retrieve "<câu hỏi>" --kind-filter episodewhich interpolates raw user input directly into the command line. This pattern is vulnerable to command injection if the input contains shell metacharacters like semicolons or pipes. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted wiki content and passes it to a subagent, creating a vulnerability surface.
- Ingestion points: Local files including
wiki/index.md,wiki/stale.json, and wiki pages underconcepts/are read and provided to a spawned subagent. - Boundary markers: While the skill provides "3 hard rules" to the subagent, it lacks explicit delimiters or instructions to ignore embedded commands within the ingested wiki data.
- Capability inventory: The skill has access to shell execution via Python and file system reads.
- Sanitization: No evidence of sanitization for the interpolated user question or the wiki content is present.
Audit Metadata