secondbrain-note
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill captures untrusted content from the user or conversation context to create persistent notes. This content is written to the filesystem in
docs/notes/and updated in YAML metadata shards within.claude/data/notes/. While this represents an attack surface for indirect prompt injection, it is the primary and intended function of the skill.\n - Ingestion points:
SKILL.md(Step 1) identifies 'Title' and 'Content' as data gathered from the user or conversation context.\n - Boundary markers: The skill instructions do not specify explicit delimiters or warnings to ignore embedded instructions within the captured content.\n
- Capability inventory: The skill performs file system write operations to create markdown documents and update YAML configuration files.\n
- Sanitization: No explicit sanitization or validation of user-provided content is defined in the workflow.
Audit Metadata