memory-management
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to read from and write to local JSON files in the
.claude/memory/directory to maintain persistence across sessions. - Ingestion points: The agent is instructed to read patterns, preferences, and decisions from
.claude/memory/**/*.json(referenced in SKILL.md). - Boundary markers: The skill suggests using structured JSON formats but does not define explicit boundary markers or instruction-ignoring delimiters for the stored content.
- Capability inventory: The skill implies the use of file system tools (reading/writing JSON) and potential command execution via the agent's integration, though no specific shell commands are provided in the skill itself.
- Sanitization: No specific sanitization or validation logic is provided for the data being read back into the context, creating a surface where malicious instructions stored in memory files could influence future agent actions.
- [DATA_EXPOSURE]: The skill encourages storing detailed project knowledge, architectural decisions, and tech stack information in local files.
- Mitigation: The skill includes explicit instructions and a 'DON'T' list (SKILL.md lines 87-92 and 506-512) warning against storing sensitive data like API keys, tokens, credentials, or private repository URLs.
Audit Metadata