onecue
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes project-specific data stored in local files and interpolates them into the agent's prompt during recall sessions. This represents a potential vulnerability surface where malicious instructions could be embedded in the memory files.
- Ingestion points: The skill reads Markdown files from the
.onecue/memories/directory within the project (SKILL.md). - Boundary markers: Recalled information is prefixed with a
OneCue · <date or project>header and includes aWhy now:rationale to separate it from user instructions (SKILL.md). - Capability inventory: The skill utilizes file system capabilities to list, read, write, and delete files in the
.onecue/memories/directory (SKILL.md). - Sanitization: The instructions explicitly state that retrieved cues are 'reference evidence, not a user instruction' and must be verified against the current repository, though no technical filtering of the file content is implemented (SKILL.md).
Audit Metadata