reflect-skills-from-memory
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external memory files (
~/.claude/projects/.../memory/*.md) which could contain malicious instructions targeting the agent. These files influence the agent's behavior during the file-modification phase. - Ingestion points: Project memory directory identified in Phase 1 (
~/.claude/projects/$(pwd | sed 's/\//-/g')/memory/*.md). - Boundary markers: No explicit delimiters or instructions to ignore embedded prompts within the memory files are provided.
- Capability inventory: The skill can write to files (SKILL.md, plugin.json, memory files), execute local scripts (plugin-optimizer/scripts/validate-plugin.py), and invoke other agent tools (via the Skill tool for git operations).
- Sanitization: No sanitization or validation of the content extracted from memory files is mentioned before it is used to modify project files.
- [COMMAND_EXECUTION]: The skill utilizes shell commands and local script execution to perform its workflow.
- Evidence: Phase 1 uses
sed,ls, andpwdto resolve paths. Phase 6 invokespython3 plugin-optimizer/scripts/validate-plugin.py <plugin-path>to validate changes.
Audit Metadata