hung-yi-lee
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides Python scripts (
scripts/hungyi_kb.py) and instructs the agent to invoke them via the shell to manage and query the knowledge base (e.g.,python3 scripts/hungyi_kb.py search "<query>"). This pattern allows the agent to execute shell commands where input strings might not be strictly sanitized, leading to potential command injection. - [EXTERNAL_DOWNLOADS]: The management scripts use well-known tools like
yt-dlpand theyoutube-transcript-apito fetch metadata and transcript files from YouTube. While YouTube is a well-known and reputable service, this constitutes an external network dependency during maintenance tasks. - [PROMPT_INJECTION]: Educational transcripts included in the knowledge base (such as
raw/youtube/transcripts/dWQVY_h0YXU.md) contain explicit examples of prompt injection and jailbreak techniques. This creates a surface for indirect prompt injection: - Ingestion points: Untrusted transcript data is read from the
raw/youtube/transcripts/directory during search and query operations. - Boundary markers: The content is processed as standard Markdown and lacks robust boundary markers to instruct the agent to ignore instructions embedded within the transcripts.
- Capability inventory: The skill possesses shell execution capabilities via its provided Python utilities.
- Sanitization: No explicit sanitization or filtering of the transcript content for malicious instructions was observed.
Audit Metadata