agentic-stack-portable-agent-memory
Fail
Audited by Gen Agent Trust Hub on May 17, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill directs the agent to download and install software from an unverified third-party GitHub repository (
github.com/codejunkie99/agentic-stack) through Homebrew and direct Git cloning.- [COMMAND_EXECUTION]: The installation instructions involve running shell and PowerShell scripts (install.sh,install.ps1) from the downloaded repository with no integrity verification.- [REMOTE_CODE_EXECUTION]: Theagentic-stack upgradecommand is designed to fetch and execute infrastructure updates from the remote repository at runtime.- [DATA_EXFILTRATION]: The skill includes functionality to export execution traces, context cards, and training artifacts to an external 'Brain' service. It also facilitates memory transfer between projects using arbitrary user-supplied commands.- [PROMPT_INJECTION]: The skill creates a surface for indirect prompt injection by processing untrusted data from local memory files without proper sanitization. - Ingestion points: Memory files like
.agent/memory/personal/PREFERENCES.mdand.agent/memory/semantic/architecture_decisions.md(SKILL.md). - Boundary markers: Absent; there are no instructions or delimiters provided to prevent the agent from obeying instructions embedded in these memory files.
- Capability inventory: The skill is capable of executing shell commands, modifying project files, and performing network operations via the
agentic-stackCLI (SKILL.md). - Sanitization: Absent; the skill does not appear to validate or escape data from external files before using it in the prompt context.
Recommendations
- AI detected serious security threats
Audit Metadata