karpathy-wiki-capture
Warn
Audited by Gen Agent Trust Hub on May 11, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on executing local shell commands (
bin/wiki,mv,ls,grep) to perform its core functions. It instructs the agent to assemble command strings using variables derived from conversation or user input. - Evidence:
echo "$BODY" | bin/wiki capture --title "<one-line title>"inSKILL.md. - Evidence:
mv <subagent-report-path> <wiki>/inbox/<basename>inSKILL.md. - [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it ingests and processes untrusted data from both user conversations and subagent report files.
- Ingestion points: The
$BODYvariable (derived from chat) and external report files specified by<subagent-report-path>(found inSKILL.md). - Boundary markers: No specific delimiters or instructions to ignore embedded instructions are provided in the command templates.
- Capability inventory: The skill has the ability to execute shell commands (
bin/wiki), move files (mv), and list directory contents (ls). - Sanitization: There are no instructions or automated steps to sanitize the input data before it is passed to the shell or written to the wiki infrastructure.
Audit Metadata