k2f-worksheet
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of a core component using the command
npx skills add suzheng/k2f. This dependency is a vendor-owned resource provided by the author 'suzheng'. - [COMMAND_EXECUTION]: Users are instructed to execute
npx skills add suzheng/k2f --skill k2fto initialize the worksheet generation environment. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted 'source material' and 'messy inputs' (ingestion points) to generate worksheets. It lacks defined delimiters or 'ignore' instructions (boundary markers) and specific sanitization logic for these inputs. The agent possesses capabilities to write files and export documents (capability inventory), which could be manipulated if malicious instructions are embedded in the ingested data.
Audit Metadata