xy-atomize
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions call for the execution of local shell commands and scripts to maintain the integrity of the knowledge base.
- The agent uses
grep -cto check for ID collisions inknowledge/atoms.jsonlbefore starting a new batch. - The agent is instructed to execute
python3 skills/xy-atomize/scripts/validate_batch.pyto verify the generated JSONL files against schema and privacy rules. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (user-provided documents) which presents an injection surface.
- Ingestion points: The skill reads content from user-specified local directories in various formats (
.md,.txt,.docx,.srt,.json) as defined in Phase 0 and Phase 2. - Boundary markers: Phase 1 implements a strict manual review where the agent must present 3 extracted samples for user confirmation before proceeding to batch extraction.
- Capability inventory: The skill can read local files, write to
knowledge/_internal/incoming/, and execute local Python and shell commands for validation and ID checking. - Sanitization: The skill uses
scripts/validate_batch.pyto enforce data formats, check for sensitive names (blacklisting), and identify potential duplicates or poorly extracted content. - [SAFE]: The skill demonstrates safe orchestration practices by explicitly instructing the agent NOT to execute the final integration tool (
tools/build_atoms.py) automatically, instead providing the command for the user to review and run manually (Phase 5).
Audit Metadata