customize-yak
Pass
Audited by Gen Agent Trust Hub on Oct 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONPERSISTENCE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill generates agent instructions based on metadata detected in project files such as
package.json,git log, andREADME. This creates an attack surface where untrusted content in a repository could influence agent behavior. - Ingestion points: Project configuration files (
package.json,pyproject.toml,Cargo.toml, etc.), commit history (git log), and user-defined settings in.agents/yesyak.json. - Boundary markers: The skill uses
<!-- yesyak:start -->and<!-- yesyak:end -->tags to encapsulate the generated instructions inAGENTS.md. - Capability inventory: Writing to project and home directory files, executing
python3scripts, and running shell commands for discovery. - Sanitization: The instructions do not specify sanitization or escaping of the ingested project metadata before it is written into the instructions block.
- [COMMAND_EXECUTION]: The skill executes shell commands to inspect the project environment (
git log) and runs a Python validation script:python3 <skills folder>/ask-yak/scripts/check_yesyak.py. - [PERSISTENCE]: The skill modifies persistent configuration files in the home directory (
~/.agents/yesyak.json) and specific agent instruction files (CLAUDE.md,GEMINI.md,AGENTS.md), which alters the agent's behavior across different projects and future sessions.
Audit Metadata