keep-the-thread-across-boundaries
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill establishes an append-only log to track objectives, decisions, and constraints, which is designed to survive session boundaries like compaction or handoffs. This mechanism allows instructions from previous conversation turns to be re-injected into the agent's context at a later time.
- Ingestion points: According to
SKILL.md, the agent must "read before acting" when crossing a boundary (compaction, model change, resume, or handoff), promoting entries from the record into the current turn. - Boundary markers: The skill uses a simple text-based command format (
push,pop,decide) but does not specify explicit sanitization or delimiters to prevent embedded instructions within the recorded content from being interpreted as agent directives. - Capability inventory: The skill relies on the agent's ability to read and write to a persistent log file on the file system to maintain state across boundaries.
- Sanitization: The instructions do not provide any mechanism for escaping or validating the content stored in the log, which allows potentially malicious constraints or decisions to be persisted and re-evaluated in subsequent turns.
Audit Metadata