story
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill launches a local Node.js server (
scripts/dashboard-server.mjs) to provide a management dashboard and programmatically opens the user's default browser to access the interface. - [EXTERNAL_DOWNLOADS]: The skill checks for new versions by querying the GitHub API for the official repository and provides a command for the user to manually update the skill using
npx, ensuring user oversight of all remote code fetching. - [INDIRECT_PROMPT_INJECTION]: The skill implements an 'Author Memory' system that stores user writing preferences to influence future AI behavior, which presents a surface for indirect prompt injection.
- Ingestion points: User input and workspace files are processed by
scripts/author_memory_commit.pyto extract preferences. - Boundary markers: The skill limits injected memory context to 2048 bytes and uses a 'pending' state for unconfirmed habits to prevent automatic adoption of new instructions.
- Capability inventory: The skill possesses file read/write permissions within the workspace and executes a local dashboard server.
- Sanitization: All ingested preferences undergo strict schema validation and text cleaning to ensure integrity.
Audit Metadata