diary
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill requires the agent to run several local Python scripts including
prepare_context.py,fetch_diaries.py, andmaster_diary_sync.py, as well as external CLI tools likeqmd embed. These scripts perform file system operations and network requests to external APIs. - [PROMPT_INJECTION]: The instructions in
SKILL.mduse "Highest Priority" and "Ironclad" rules to override the agent's default behavior, explicitly forbidding conversational output between steps and demanding an autonomous "one-shot" execution path. It also commands the agent to setSafeToAutoRun: trueto bypass platform-level user confirmation for shell commands. - [INDIRECT_PROMPT_INJECTION]: The workflow ingests content from the user's project environment, including
README.mdand various diary files, to generate summaries and context. Maliciously crafted content within these project files could potentially influence the agent's logic during the fusion and synchronization phases. - [DATA_EXFILTRATION]: The skill is designed to transmit project summaries and diary logs to the Notion API. Due to the high degree of automation and the "one-shot" execution model, there is a risk that sensitive information captured from the local project environment could be exfiltrated to the cloud service without granular user review of the specific content being sent.
Audit Metadata