decision-drift-guard
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill implements persistent decision tracking using a local directory (
.agents/decision-ledger/). This is a legitimate functional requirement for maintaining state across a session and does not interact with sensitive system files or credentials. - [PROMPT_INJECTION]: The skill processes historical data from a ledger file which influences the agent's logic, creating a surface for indirect prompt injection.
- Ingestion points: Data is read from the session-specific ledger file located at
.agents/decision-ledger/sessions/<session-id>.md. - Boundary markers: The instructions do not specify explicit delimiters or "ignore" instructions for the ledger content.
- Capability inventory: The skill is limited to filesystem read and write operations for the ledger; it does not perform network requests or execute arbitrary code.
- Sanitization: No explicit sanitization or filtering of the ledger content is described.
- Mitigation: The risk of instruction override is significantly mitigated by the "Gate 1" and "Gate 2" logic, which mandates a pause for user review and confirmation before any decision is superseded or a conflict is resolved.
Audit Metadata