recall-conversations

Pass

Audited by Gen Agent Trust Hub on May 15, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [SAFE]: The skill is designed to manage local conversation history and does not contain any malicious patterns, obfuscation, or unauthorized network activity.
  • [COMMAND_EXECUTION]: The skill uses the Bash tool to execute internal Python utility scripts (recent_chats.py and search_conversations.py). These scripts are used solely to interface with the local conversation database and present no risk of arbitrary command execution.
  • [PROMPT_INJECTION]: The skill features an indirect prompt injection surface as it retrieves and re-injects content from past conversations into the agent's current context. This is a standard characteristic of memory-based skills and is managed through formatting and sanitization.
  • Ingestion points: JSONL log files located in ~/.claude/projects/ are parsed by scripts/memory_lib/parsing.py.
  • Boundary markers: The skill uses Markdown headers and bold role labels in scripts/memory_lib/formatting.py to separate retrieved history from new instructions.
  • Capability inventory: The skill can execute local Python scripts via the Bash tool to query the history.
  • Sanitization: scripts/memory_lib/content.py provides logic to sanitize FTS search terms and remove internal command-related XML-like tags from message content.
Audit Metadata
Risk Level
SAFE
Analyzed
May 15, 2026, 01:18 PM
Security Audit — agent-trust-hub — recall-conversations