daily-update
Fail
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: HIGHPERSISTENCECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [PERSISTENCE]: The skill creates a launchd agent by writing a plist file to
~/Library/LaunchAgents/and loading it withlaunchctl. This ensures the maintenance script runs automatically every day at 9 AM or upon login. - [PERSISTENCE]: The skill modifies user shell configuration files (
.zshrcand.bashrc) by appending asourcecommand that executes a local script (wiki-notify.sh) every time a new terminal session is started. - [COMMAND_EXECUTION]: The skill uses
sedto modify configuration templates and redirects output (>>) to append code to critical shell startup files. It also executes local scripts viabashand manages system agents usinglaunchctl. - [INDIRECT_PROMPT_INJECTION]: The skill performs bulk reading of all markdown files within the user's vault to regenerate the index and create semantic snapshots in
hot.md. - Ingestion points: Markdown files discovered via
findwithin the vault path,.manifest.json, andindex.md. - Boundary markers: No boundary markers or instructions to ignore embedded commands are present when processing vault content.
- Capability inventory: File system write access (vault files, state directory, shell configuration files), execution of shell commands (
bash,sed,launchctl), and spawning of subagents (impl-validator). - Sanitization: No sanitization or validation of the content read from the vault files is performed before it is processed or summarized.
Recommendations
- AI detected serious security threats
Audit Metadata