soia-pkm-library-book-catalog
Pass
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill processes local Markdown files from the Obsidian vault to generate summaries and backfill records, which presents a surface for indirect prompt injection.
- Ingestion points: Multiple scripts (backfill_reading_records.py, gen_library_md.py, gen_records_md.py, and gen_genre_library_md.py) recursively scan and read content from all Markdown files within the user's library directory.
- Boundary markers: The skill does not implement boundary markers or instructions to ignore embedded commands when processing content from the library files.
- Capability inventory: The skill possesses file-writing capabilities across all primary scripts to create and update Markdown files within the Obsidian vault.
- Sanitization: The skill relies on basic regular expressions for frontmatter extraction and does not perform sanitization to prevent malicious instructions in processed files from affecting the agent's context or the integrity of generated summaries.
- [EXTERNAL_DOWNLOADS]: The documentation references installation commands and support documents from the vendor's GitHub repository and the WeChat Reading service.
- Evidence: The skill documentation (SKILL.md) and environment helper (library_env.py) reference github.com/soia-team/soia-open-skills and weread.qq.com for installation instructions and dependency status checking. These references target the vendor's own infrastructure and a well-known service and are documented here for transparency.
Audit Metadata