close-session
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill presents an attack surface by scanning current session data for observations to be recorded in
.claude/memory/MEMORY.md. - Ingestion points: The skill instructions in Step 1 direct the agent to "Scan this session for observations worth keeping."
- Boundary markers: There are no explicit instructions for the agent to use delimiters or ignore embedded commands within the scanned content, although a standardized
[YYYY-MM-DD]prefix is enforced for each entry. - Capability inventory: The skill uses
WriteandEdittools to modify several local files, including.claude/memory/MEMORY.md,.claude/rules/, and various project documentation files. - Sanitization: No specific sanitization or filtering logic is prescribed for the session data before it is written to the memory file.
- Mitigation: The risk of malicious instructions being codified is effectively mitigated by the requirement in Step 2 for the user to provide explicit verbal consent ("yes") before any candidate pattern is promoted to a permanent rule or concept article.
Audit Metadata