remind
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: Accesses sensitive local directories containing user conversation history.\n
- Evidence: The script
scripts/search.pyand instructions inSKILL.mddirect the agent to read from~/.scribe/scribe.dband~/.claude/projects/. Accessing these locations exposes the full history of previous AI interactions, which may include sensitive tokens, passwords, or proprietary code.\n- [INDIRECT_PROMPT_INJECTION]: Ingests unverified historical data that can influence agent behavior.\n - Ingestion points: History is retrieved from SQLite (Scribe DB) and JSONL files via
scripts/search.py.\n - Boundary markers: The skill does not use boundary markers or XML tags to encapsulate historical text, making it possible for the agent to mistake past text for current instructions.\n
- Capability inventory: The agent has high-privilege capabilities including shell command execution (
python3,ls,cat) and file system access.\n - Sanitization: The
search.pyscript performs basic HTML/XML tag stripping but does not filter for semantic prompt injection patterns or malicious instructions in the recalled text.
Audit Metadata