forget
Warn
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides a Bash command template in
SKILL.mdthat incorporates the<source_id>argument directly into a Git commit command string:git ... commit --quiet -m "forget: <source_id>". This pattern is vulnerable to command injection; an attacker could provide asource_idcontaining shell metacharacters (such as backticks, semicolons, or dollar-sign parentheses) to execute arbitrary commands in the context of the agent's environment. - [PROMPT_INJECTION]: The skill exposes an indirect prompt injection surface by processing untrusted data (the memory ID) and passing it to a powerful tool (Bash) without isolation or sanitization.
- Ingestion points: The
<source_id>input provided by the user and processed in theSKILL.mdfile. - Boundary markers: There are no delimiters or explicit instructions provided to the agent to escape or isolate the interpolated input within the shell command.
- Capability inventory: The skill uses the
Bashtool to interact with the file system and manage a Git repository as described inSKILL.md. - Sanitization: No validation or sanitization logic is included to ensure the memory ID contains only safe, alphanumeric characters before execution.
Audit Metadata