wiki-ingest
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and synthesizes knowledge from untrusted files (PDFs, images, code, and text) located in the user-controlled
raw/directory. This creates a surface for indirect prompt injection where malicious instructions embedded in these files could attempt to hijack the agent's behavior. - Ingestion points: Any file placed in the
<wiki_root>/raw/directory is listed, read, and processed (SKILL.md Step 1). - Boundary markers: The skill features an explicit 'Content Trust Boundary' section that mandates the agent ignore any commands, scripts, or instructions found in source documents, treating all content strictly as data (SKILL.md).
- Capability inventory: The skill uses filesystem search, read, write, and move operations, along with optional PDF extraction and vision tools to perform its task (SKILL.md Capability Requirements).
- Sanitization: The instructions emphasize synthesis over verbatim copying and require that source content must never modify the skill's own logic, routing, or processing rules. Additionally, the skill enforces a YAML schema for created pages that restricts the types and length of frontmatter fields.
Audit Metadata