wiki-yylo
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to retrieve and process information from external YYLO Ledger records using search and get commands. This creates a risk where malicious instructions stored in the wiki records could influence the agent's actions when the information is read back into the context.\n
- Ingestion points: Information retrieved via
yy ledger wiki getandsearchas described inSKILL.md.\n - Boundary markers: The instructions do not define boundary markers or delimiters to separate ledger content from system instructions.\n
- Capability inventory: The skill uses shell-based tools (
yy ledger,yylo-ledger) to create, search, and update project records.\n - Sanitization: There is no mention of sanitizing or validating the Markdown content retrieved from the ledger before it is used by the agent.\n- [COMMAND_EXECUTION]: The skill enables shell directives (
enable-shell-directives: true) and provides templates for command-line interactions with project-owned tools. This enables the agent to execute shell commands directly to manage the knowledge base, which is an intended but powerful capability.
Audit Metadata