secondbrain-review
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests markdown files from the
docs/directory and performs file-write operations to update their frontmatter. This creates a surface area where an attacker who can modify these documentation files could embed malicious instructions intended to be followed by the agent during the review process. - Ingestion points: Target markdown files residing in the
docs/directory (Step 2). - Boundary markers: The instructions do not define delimiters or specific "ignore" markers to prevent the agent from being influenced by the content of the files it reads.
- Capability inventory: The skill utilizes the
Edittool to write frontmatter updates back to the file system (Step 5). - Sanitization: There is no evidence of sanitization, validation, or escaping of the file content before the agent processes it for frontmatter extraction and modification.
Audit Metadata