zotero-keeper-harness
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands for development tasks using
uvandnpm. - Evidence includes canonical commands like
uv run pytest,npm run compile, andnpm testlocated inSKILL.md. - These commands are scoped to specific directories (
mcp-server,vscode-extension,external/pubmed-search-mcp). - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests data from local repository files and possesses command execution capabilities.
- Ingestion points: Reads instructions and workflows from
.clinerules/,.clinerules/workflows/, and.claude/skills/within the repository. - Boundary markers: The instructions do not define explicit delimiters or warnings to ignore potentially malicious instructions embedded in the project files.
- Capability inventory: Includes the ability to run Python tests, linters (Ruff, MyPy), and Node.js build/test scripts.
- Sanitization: There is no evidence of sanitization or validation performed on the contents of the repository files before processing or command execution.
Audit Metadata