grokipedia-cli

Pass

Audited by Gen Agent Trust Hub on Mar 10, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses the grokipedia CLI tool to perform various operations, including article retrieval, full-text searching, and exporting data to the local filesystem (e.g., grokipedia backup --all --output grokipedia-backup.zip).- [PROMPT_INJECTION]: The skill presents a surface for indirect prompt injection or command injection by directly interpolating user-provided text into the --query flag of the grokipedia search command. Evidence Chain: 1. Ingestion points: User-controlled search queries are processed by SKILL.md. 2. Boundary markers: No delimiters or instructions are provided to the agent to treat the input as literal data. 3. Capability inventory: The agent executes shell commands using the grokipedia utility. 4. Sanitization: No input validation or escaping mechanisms are specified for the interpolated query strings.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 10, 2026, 03:37 PM