reflect
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted conversation transcripts and session artifacts to identify mistakes, friction points, and lessons learned. This data is then used to propose and implement updates to the agent's memory and skills. While the skill includes several defensive layers, the process of incorporating external input into the agent's core instructions and long-term memory presents a surface for indirect prompt injection.
- Ingestion points: The skill scans 'available conversation and relevant artifacts' (SKILL.md, Section 1).
- Boundary markers: There are no explicit delimiters defined for the ingested transcript data, though the skill notes the limits of reviewed evidence.
- Capability inventory: The skill can search files using 'grep' and update memory or skill files using 'file-editing' tools (SKILL.md, Sections 4 and 5).
- Sanitization: The skill explicitly excludes credentials from persisted items, checks for duplicates/contradictions before writing, and requires user authorization for all memory writes and skill edits (SKILL.md, Section 4; references/capture-and-routing.md).
Audit Metadata