memory-management
Pass
Audited by Gen Agent Trust Hub on Oct 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines a tiered memory architecture that ingests external content, stores it, and interpolates it into prompts for summarization and relevance scoring. This creates a surface for indirect prompt injection where malicious instructions stored in memory could influence agent behavior.
- Ingestion points: Content enters the system through
TieredMemory.remember()andContextManager.build_context()inSKILL.md. - Boundary markers: The system uses minimal labels such as
[Summary of earlier context]and## Key Eventsbut lacks strict delimiters or escape sequences to prevent embedded instructions in memories from being followed by the LLM. - Capability inventory: The skill uses
vector_store.store()andvector_store.search()(network/IO) and callsllm.generate()inMemorySummarizer,MemoryConsolidator, andMemoryRetrieverto process memory content. - Sanitization: There is no evidence of instruction filtering, sanitization, or validation of memory content before it is re-interpolated into prompt templates.
Audit Metadata