memento
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill directs the agent to gather status information from potentially untrusted sources like the repository's working tree, current process list, and the results of previous tool executions. This creates a surface for indirect prompt injection if those external sources contain hidden instructions meant to subvert the agent's behavior.
- Ingestion points: The skill explicitly instructs the agent to read from the 'working tree', 'running processes', and 'the last few tool results' in SKILL.md.
- Boundary markers: There are no instructions for using delimiters or boundary markers to isolate data retrieved from these sources from the agent's internal instructions.
- Capability inventory: The skill relies on the agent's existing capabilities to read the file system and list system processes.
- Sanitization: The instructions do not include any requirements to sanitize, validate, or escape the content retrieved from the environment before processing it for the status report.
Audit Metadata