wiki-init
Warn
Audited by Gen Agent Trust Hub on Apr 2, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
references/adapter-protocol.mdfile specifies the use ofnpx dot-wiki focus add <path>. This command triggers the download and execution of a package from the npm registry at runtime without version constraints. - [COMMAND_EXECUTION]: The skill automates several shell operations to establish the wiki structure, including creating directories (
mkdir), generating symbolic links (ln,mklink), and initializing a new Git repository (git init). - [PROMPT_INJECTION]: The skill ingests data from the local environment by reading project-specific files (
AGENTS.md,CLAUDE.md) and interpolating shell command output (fromgit rev-parse) into directory paths. This creates an indirect prompt injection surface where maliciously named local directories or file contents could influence the agent's behavior during the setup process.
Audit Metadata