outline-wiki-upload
Warn
Audited by Gen Agent Trust Hub on Jul 3, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides specific bash snippets for the agent to execute, including complex command substitutions and pipes (e.g.,
KEY=$(jq -r ... <(curl ...))). This bypasses standard tool abstractions and executes arbitrary shell commands for file management. - [DATA_EXFILTRATION]: The skill facilitates the transfer of local data (document text and binary images) to an external Outline Wiki server. It explicitly directs the agent to retrieve and use the user's
OUTLINE_API_KEYfrom configuration files for these operations, representing a risk of credential and data exposure. - [REMOTE_CODE_EXECUTION]: The workflow includes a
python3 -ccommand that dynamically generates and executes a Python script to prepare JSON payloads from local file content at runtime. - [EXTERNAL_DOWNLOADS]: The skill performs outbound network requests to user-defined Outline Wiki endpoints via
curlto manage attachments and documents. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection. 1. Ingestion points: reads content from
summary.mdand existing Wiki documents through search and read tools. 2. Boundary markers: metadata uses markdown code blocks, but other content lacks delimiters. 3. Capability inventory: shell execution (curl,python3) and file system access. 4. Sanitization: no evidence of content validation or escaping before processing the ingested data into commands or uploads.
Audit Metadata