soia-pkm-clip-github-repo
Pass
Audited by Gen Agent Trust Hub on Jul 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/gen_repo_catalog.pyexecutesgitcommands usingsubprocess.run. The implementation follows security best practices by passing arguments as a list rather than a shell string, which prevents command injection vulnerabilities from untrusted URL inputs. - [EXTERNAL_DOWNLOADS]: The skill interacts with external servers to clone Git repositories via the
git clonecommand. This is a core functionality required for its stated purpose of archiving open-source projects. - [PROMPT_INJECTION]: The skill processes untrusted external data which introduces a risk of indirect prompt injection.
- Ingestion points: Content is read from the README files of cloned repositories in
scripts/gen_repo_catalog.pythrough thefirst_summary_linefunction. - Boundary markers: The extracted summary is placed directly into the project card's Markdown body without specific delimiters or instructions to downstream agents that this content is untrusted.
- Capability inventory: The skill has the capability to write to the local filesystem and execute Git-related subprocesses.
- Sanitization: The
first_summary_linefunction includes logic to strip HTML comments, images, and code blocks from the input text before extraction, which mitigates simple injection vectors but does not fully eliminate the risk of adversarial text being included in the vault.
Audit Metadata