secondbrain-db
Warn
Audited by Gen Agent Trust Hub on May 2, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to download and install the 'sbdb' CLI tool from the author's GitHub repository ('github.com/sergio-bershadsky/secondbrain-db').
- [COMMAND_EXECUTION]: The skill requires shell command execution to perform file management, indexing, and health checks using the 'sbdb' tool.
- [REMOTE_CODE_EXECUTION]: The skill supports 'virtual fields' in schemas that execute Starlark code to transform document content; although described as sandboxed, this involves dynamic execution of logic defined in project-level configuration files.
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its core function of ingesting and processing untrusted markdown data.
- Ingestion points: Markdown files and YAML records located in the project's documentation and records directories.
- Boundary markers: No explicit delimiters or 'ignore' instructions are provided to separate document content from agent instructions.
- Capability inventory: The agent can perform file reads, writes, deletions, and shell command execution via the 'sbdb' tool.
- Sanitization: While a Starlark sandbox is mentioned for virtual field logic, no sanitization or escaping of the actual document content is described before it is interpolated into the agent's prompt context.
Audit Metadata