soia-pkm-transform-article-learning

Warn

Audited by Gen Agent Trust Hub on Jul 16, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The Python scripts notebooklm_health.py, notebooklm_artifact_matrix.py, and local_artifact_smoke.py use the subprocess.run method to execute shell commands for system automation and CLI interaction.
  • [REMOTE_CODE_EXECUTION]: In scripts/local_artifact_smoke.py, a JavaScript block is dynamically constructed as a string and executed via node -e to drive the Playwright library for rendering HTML content into visual artifacts.
  • [EXTERNAL_DOWNLOADS]: The documentation provides instructions to install third-party dependencies such as the notebooklm-py CLI and the open-design repository from external sources outside the vendor's primary control.
  • [PROMPT_INJECTION]: The skill ingests untrusted content from articles or URLs and interpolates it into prompt templates, creating a vector for indirect prompt injection. Ingestion points: source articles provided via local paths or URLs; Boundary markers: prompt templates in the references directory interpolate content without robust delimiters to isolate potentially malicious instructions; Capability inventory: the skill can execute shell commands, perform file system operations, and interact with external APIs; Sanitization: content interpolated into rendering templates is escaped using html.escape.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Jul 16, 2026, 03:01 AM
Security Audit — agent-trust-hub — soia-pkm-transform-article-learning