knowledge-ops
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines workflows for ingesting data from external sources, which naturally presents an attack surface for indirect prompt injection.
- Ingestion points: The workflow involves ingesting external documents, conversation exports from various AI platforms, browser bookmarks, and GitHub activity events into the agent's memory layers.
- Boundary markers: The skill recommends using YAML frontmatter for file metadata, but does not specify technical delimiters to separate untrusted ingested content from the agent's internal reasoning.
- Capability inventory: The skill utilizes file system writes (writing to memory files in ~/.claude/projects/), MCP memory tools for structured data management, and Git commands for syncing durable notes.
- Sanitization: The instructions include a 'Quality Gate' that mandates the redaction of sensitive credentials (API keys, passwords) before any content is stored in Git-tracked files, providing a mitigation against accidental data exposure.
Audit Metadata