memory-onboarding

Pass

Audited by Gen Agent Trust Hub on Oct 12, 2026

Risk Level: SAFEPERSISTENCEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [PERSISTENCE]: The skill guides the user to implement a 'Startup Router' pattern as detailed in references/assistant-setup.md and SKILL.md (Phase 4). Users are instructed to install a 'persistent instruction stub' in their assistant's configuration (such as a system prompt or custom instructions). This stub mandates that the agent must read a specific note from the knowledge base at the beginning of every session, creating a persistent bootloader for agent behavior.
  • [INDIRECT_PROMPT_INJECTION]: The skill's architecture relies on loading instructions from markdown notes, which introduces a surface for indirect prompt injection if untrusted data is ingested into the system. Ingestion points: The agent is instructed to use read_note to fetch the 'Startup Router' and dispatched instruction notes. Boundary markers: While the 'Startup Router' uses a read-me-first header, there are no explicit instructions or mechanisms to sanitize or ignore embedded commands within the note body. Capability inventory: The skill uses tools for reading, writing, and searching notes across directories (write_note, read_note, search_notes, list_directory). Sanitization: No specific sanitization or content validation is provided to distinguish between administrative instructions and regular data within the markdown files.
  • [EXTERNAL_DOWNLOADS]: In SKILL.md (Phase 0), the agent is instructed to fetch live documentation and index files from https://docs.basicmemory.com/llms.txt. This domain is a vendor-owned resource associated with the author basicmachines-co and the 'Basic Memory' toolset, representing a standard operational dependency.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 12, 2026, 11:40 PM