rlm-curator
Pass
Audited by Gen Agent Trust Hub on Apr 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on executing various local Python scripts (
distiller.py,inventory.py,inject_summary.py,cleanup_cache.py) and delegating batch processing to external agent swarms via theagent-loops:agent-swarmplugin. - [DATA_EXFILTRATION]: The skill aggregates file summaries into a centralized
rlm_summary_cache.json. This ledger consolidates sensitive architectural and functional knowledge about the repository. The instructions explicitly warn about the risk of exposing secrets if this file is accidentally committed to a public repository. - [PROMPT_INJECTION]: The instructions implement 'Negative Instruction Constraints' (the 'Electric Fence') to prevent agents from manually editing JSON cache files. While intended for data integrity, these patterns represent behavioral constraints that are targets for potential override or bypass attempts.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted local data into a format used for agent decision-making. \n- Ingestion points: Reads source code and documentation from user-defined directories (e.g.,
src/,docs/). \n- Boundary markers: No specific delimiters or instructions to ignore embedded commands within source files are specified for the distillation process. \n- Capability inventory: The skill executes local scripts, performs network requests to Ollama, and handles concurrent file writes usingfcntl.flock. \n- Sanitization: No sanitization of the generated summaries is documented before they are added to the semantic ledger used by other agents.
Audit Metadata