wiki-ingest
Pass
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: Indirect Prompt Injection Surface detected in the document ingestion workflow.
- Ingestion points: The skill reads external files (PDFs, markdown, transcripts) and vault notes using the
Readandobsidian_read_notetools. - Boundary markers: Absent. The workflow does not utilize delimiters or specific instructions to help the agent distinguish between source content and its own processing logic.
- Capability inventory: The skill possesses significant capabilities including vault searching (
obsidian_rag_query), note creation (obsidian_create_note), and section modification/frontmatter updates (obsidian_insert_at_heading,obsidian_replace_section,obsidian_update_frontmatter). - Sanitization: Absent. There is no evidence of filtering or escaping content extracted from external sources before it is interpolated into the extraction logic or written to the vault.
- Mitigation: The risk is significantly reduced by Step 5, which mandates presenting an 'Ingest Plan' and waiting for explicit user confirmation before any writes or merges occur.
Audit Metadata