dag-recall
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill retrieves and processes data from conversation history nodes which could contain untrusted instructions if an attacker influenced past sessions.
- Ingestion points: Memory node files are read from the ~/.openclaw/lcm-dag/nodes/ directory.
- Boundary markers: The skill uses simple citation labels such as [s-d1-003] when assembling answers but lacks robust delimiters or safety instructions to prevent the agent from following commands embedded in the retrieved memory content.
- Capability inventory: The script performs file reads and SQLite queries. It does not have network access or arbitrary file writing capabilities beyond its own state management.
- Sanitization: Data retrieved from the memory nodes is assembled into a response for the agent without sanitization or escaping.
Audit Metadata