ask-ai-bookkeeping
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions provide a shell command template:
python3 "$AI_BOOKKEEPING_HOME/scripts/bookkeeping.py" --config "/absolute/path/to/config.json" ask "用户问题". Passing raw user input ("用户问题") directly into a shell command is a standard command injection vector if the execution environment does not perform proper escaping or use safe argument passing mechanisms. - [INDIRECT_PROMPT_INJECTION]: The skill defines an attack surface for indirect prompt injection by taking untrusted natural language input from the user and using it as a parameter for a powerful capability (executing a Python script that reads a ledger).
- Ingestion points: User queries provided as the "用户问题" argument in the query flow in SKILL.md.
- Boundary markers: None specified to prevent the agent from misinterpreting embedded instructions in the user's question.
- Capability inventory: Execution of a local Python script via
python3(bookkeeping.py) which has access to the filesystem (ledger data and configuration file). - Sanitization: No explicit instructions are provided to sanitize or escape the user-provided string before passing it to the shell command.
Audit Metadata