ag2-knowledge-and-memory
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill implements a persistent memory architecture where untrusted user input is processed, summarized by an LLM, and subsequently injected into future prompts through assembly policies like
WorkingMemoryPolicyandEpisodicMemoryPolicy. - Ingestion points: User input delivered through
agent.askcalls as shown injournal_companion.pyandlong_doc_chat.py. - Boundary markers: Not explicitly defined in the default aggregate prompt templates shown in
SKILL.md; however, theWorkingMemoryAggregateallows for custom prompt overrides to structure the merge of existing and new context. - Capability inventory: Includes file system writes (
DiskKnowledgeStore), network operations (viaRedisKnowledgeStore), and optional tool execution (theknowledgeaction-group tool). - Sanitization: No explicit sanitization or filtering of user-provided content is demonstrated before aggregation or injection, relying on the underlying LLM's summarization behavior to extract relevant state.
Audit Metadata