xy-idea-desk
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on a bundled Python script (
scripts/atoms-search.py) to perform knowledge retrieval. This script is executed locally to search through the vendor's "atoms" database. - [EXTERNAL_DOWNLOADS]: The search script performs network requests to the vendor's API endpoint (
api.xyskill.xyz) to search the full knowledge cloud when local data is unavailable. - [DATA_EXFILTRATION]: The skill interacts with the local file system by accessing a specific configuration file (
~/.xy/config.json) and scanning standard agent skill directories (e.g.,~/.claude/skills/xy) to locate the root directory of its data repository. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user input (in the form of "ideas" or "灵感") which is then written to local files and used to generate search queries for the knowledge base.
- Ingestion points: Conversational user input used to define "ideas" written to
灵感池/or深化中/directories. - Boundary markers: No explicit delimiters or boundary markers are used when interpolating user ideas into file content.
- Capability inventory: The skill possesses file-writing capabilities across its structured directory and executes a local Python utility for search functions.
- Sanitization: There is no evidence of input sanitization or filtering applied to user-provided text before it is stored or used in search parameters.
Audit Metadata