keep-the-thread-across-boundaries

Pass

Audited by Gen Agent Trust Hub on Sep 11, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill establishes an append-only log to track objectives, decisions, and constraints, which is designed to survive session boundaries like compaction or handoffs. This mechanism allows instructions from previous conversation turns to be re-injected into the agent's context at a later time.
  • Ingestion points: According to SKILL.md, the agent must "read before acting" when crossing a boundary (compaction, model change, resume, or handoff), promoting entries from the record into the current turn.
  • Boundary markers: The skill uses a simple text-based command format (push, pop, decide) but does not specify explicit sanitization or delimiters to prevent embedded instructions within the recorded content from being interpreted as agent directives.
  • Capability inventory: The skill relies on the agent's ability to read and write to a persistent log file on the file system to maintain state across boundaries.
  • Sanitization: The instructions do not provide any mechanism for escaping or validating the content stored in the log, which allows potentially malicious constraints or decisions to be persisted and re-evaluated in subsequent turns.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 11, 2026, 01:25 PM
Security Audit — agent-trust-hub — keep-the-thread-across-boundaries