qa-memory
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCREDENTIALS_UNSAFEPROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill manages external data in the .qa/ directory which could contain malicious content. It addresses this risk through several layers:
- Ingestion points: Reads markdown and YAML files from the project repository.
- Boundary markers: Enforces a strict schema using H2 headers and limited YAML parsing to prevent injection at the data structure level.
- Capability inventory: The skill allows file system writes to the .qa/ directory and advises agents to treat stored commands as data requiring verification rather than direct instructions.
- Sanitization: Employs a validator script that scans for hidden instructions and sensitive data.
- [DYNAMIC_EXECUTION]: The validator script uses a dynamic import for a standard library call to sys.exit. This is a benign code pattern with a static module name and no untrusted input.
- [CREDENTIALS_UNSAFE]: The skill features a security scanner that uses regular expressions to detect and block the storage of sensitive credentials like API keys and private keys within the knowledge base.
- [PROMPT_INJECTION]: The skill includes explicit detection for prompt injection keywords (e.g., 'disregard instructions') in its validator script, providing a defensive layer against malicious instructions embedded in the project memory.
Audit Metadata