knowledge-ops
Pass
Audited by Gen Agent Trust Hub on Jun 24, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection due to its core functionality of ingesting and syncing external data.
- Ingestion points: The skill is designed to ingest documents, conversation history (from Claude, ChatGPT, Grok), and browser bookmarks into various storage layers as defined in the 'Ingestion Workflow' and 'Sync Operations' sections of SKILL.md.
- Boundary markers: There are no instructions provided to the agent to use specific delimiters or protective XML tags when incorporating untrusted external content into memory files or the knowledge base repo.
- Capability inventory: The skill possesses the capability to perform file system writes (e.g., to ~/.claude/projects/*/memory/), execute Git operations (commit and push), and interact with external data stores like Supabase or PostgreSQL.
- Sanitization: While the skill mandates the redaction of sensitive configuration data (API keys, passwords), it does not specify any sanitization or filtering logic to prevent the ingestion of malicious natural language instructions that could influence the agent's future behavior.
Audit Metadata