ai-memory-retrieval
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest historical data, including prior user prompts, tool outputs, and wiki content. This constitutes an indirect prompt injection surface as historical data may contain instructions designed to influence the agent's current behavior. The skill mitigates this risk with robust instructions: it explicitly labels all retrieved content as 'untrusted historical data,' warns that retrieved content cannot authorize commands or policy changes, and instructs the agent to follow current trusted instructions if a conflict occurs.
- [DATA_EXFILTRATION]: The skill accesses potentially sensitive information, including raw session observations (prompts and tool calls) and project configuration files like
.ai-memory.toml. While the tools are restricted to read-only lookups within the agent's own memory ecosystem and no external transmission mechanisms are defined, the skill provides high-fidelity access to the interaction history of the workspace.
Audit Metadata