skills/suzheng/k2f/k2f-worksheet/Gen Agent Trust Hub

k2f-worksheet

Pass

Audited by Gen Agent Trust Hub on Oct 1, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill requires the installation of a core component using the command npx skills add suzheng/k2f. This dependency is a vendor-owned resource provided by the author 'suzheng'.
  • [COMMAND_EXECUTION]: Users are instructed to execute npx skills add suzheng/k2f --skill k2f to initialize the worksheet generation environment.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted 'source material' and 'messy inputs' (ingestion points) to generate worksheets. It lacks defined delimiters or 'ignore' instructions (boundary markers) and specific sanitization logic for these inputs. The agent possesses capabilities to write files and export documents (capability inventory), which could be manipulated if malicious instructions are embedded in the ingested data.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 1, 2026, 02:00 PM