helix-memory-system
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines an architecture for ingesting and processing untrusted external content (e.g., chat logs, source documents, connector events) into a persistent database, creating a potential surface for indirect prompt injection.
- Ingestion points: Data ingestion is handled by the
ingestChunkandcreateMemoryoperations defined inEXAMPLES.mdandEXAMPLES.rust.md. - Boundary markers: The skill advocates for a 'Contextual Extraction' layer (detailed in
SKILL.md) that resolves context and structures facts before storage, which acts as a mediation layer between raw input and the stored memory. - Capability inventory: The skill possesses database write and delete capabilities using the HelixDB DSL; it does not have system-level execution or generic network capabilities.
- Sanitization: The implementation instructions encourage semantic validation and relationship classification to ensure durable facts are self-contained, though character-level sanitization is left to the application developer.
Audit Metadata