vestige-auto-memorise
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill implements an indirect prompt injection surface (Category 8) by design. It proactively monitors user-controlled conversation data to trigger automated tool executions.
- Ingestion points: The skill parses the entire conversation history for specific text cues defined in
SKILL.md. - Boundary markers: Absent; there are no instructions to the agent to distinguish between informational content and malicious instructions within the captured text.
- Capability inventory: The skill triggers shell commands using the
vestigeCLI tool to modify project state. - Sanitization: Absent; the instructions do not require the agent to escape shell metacharacters or validate the content before processing.
- [COMMAND_EXECUTION]: The skill is vulnerable to command injection through shell argument interpolation. It instructs the agent to place untrusted snippets from the conversation directly into shell command templates, such as
vestige note add "<the fact>". A malicious actor could provide a message containing shell metacharacters (e.g., backticks, semicolons, or pipes) to break out of the command string and execute arbitrary code on the underlying system.
Audit Metadata