recall-conversations
Pass
Audited by Gen Agent Trust Hub on May 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill is designed to manage local conversation history and does not contain any malicious patterns, obfuscation, or unauthorized network activity.
- [COMMAND_EXECUTION]: The skill uses the
Bashtool to execute internal Python utility scripts (recent_chats.pyandsearch_conversations.py). These scripts are used solely to interface with the local conversation database and present no risk of arbitrary command execution. - [PROMPT_INJECTION]: The skill features an indirect prompt injection surface as it retrieves and re-injects content from past conversations into the agent's current context. This is a standard characteristic of memory-based skills and is managed through formatting and sanitization.
- Ingestion points: JSONL log files located in
~/.claude/projects/are parsed byscripts/memory_lib/parsing.py. - Boundary markers: The skill uses Markdown headers and bold role labels in
scripts/memory_lib/formatting.pyto separate retrieved history from new instructions. - Capability inventory: The skill can execute local Python scripts via the
Bashtool to query the history. - Sanitization:
scripts/memory_lib/content.pyprovides logic to sanitize FTS search terms and remove internal command-related XML-like tags from message content.
Audit Metadata