forget

Warn

Audited by Gen Agent Trust Hub on Jun 13, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides a Bash command template in SKILL.md that incorporates the <source_id> argument directly into a Git commit command string: git ... commit --quiet -m "forget: <source_id>". This pattern is vulnerable to command injection; an attacker could provide a source_id containing shell metacharacters (such as backticks, semicolons, or dollar-sign parentheses) to execute arbitrary commands in the context of the agent's environment.
  • [PROMPT_INJECTION]: The skill exposes an indirect prompt injection surface by processing untrusted data (the memory ID) and passing it to a powerful tool (Bash) without isolation or sanitization.
  • Ingestion points: The <source_id> input provided by the user and processed in the SKILL.md file.
  • Boundary markers: There are no delimiters or explicit instructions provided to the agent to escape or isolate the interpolated input within the shell command.
  • Capability inventory: The skill uses the Bash tool to interact with the file system and manage a Git repository as described in SKILL.md.
  • Sanitization: No validation or sanitization logic is included to ensure the memory ID contains only safe, alphanumeric characters before execution.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Jun 13, 2026, 07:52 AM
Security Audit — agent-trust-hub — forget