knowledge-indexer
Pass
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted external Markdown documents, which presents a surface for indirect prompt injection attacks where document content could attempt to influence the AI's behavior.
- Ingestion points: The skill reads user-defined source Markdown files during the annotation phase in Step 3.
- Boundary markers: The instructions lack explicit delimiters or markers to isolate document content from the processing logic.
- Capability inventory: The skill utilizes tools to read from and write to the local file system (specifically within the 'knowledge-base' directory).
- Sanitization: While it validates keywords against the source text, it does not sanitize the document content for potential embedded instructions.
- Confirmation Mechanisms: The implementation of mandatory user confirmation steps in Step 4 (annotation review) and Step 5 (final file content preview) provides a strong defense against automated execution of injected instructions.
Audit Metadata