memory-types-team-stores
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONNO_CODE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides detailed instructions for the agent to extract information from user inputs and store it in a memory system (categorized as user, feedback, project, or reference). These memories are explicitly intended to 'guide your behavior' and 'tailor your future behavior' in future turns. This architecture establishes a surface for indirect prompt injection:
- Ingestion points: The agent is instructed to ingest data from user messages and corrections within
SKILL.md. - Boundary markers: There are no instructions for sanitizing or delimiting the content of these memories to prevent embedded instructions from being interpreted as agent logic.
- Capability inventory: The skill leverages the agent's ability to read and write to a persistent memory store to influence long-term logic.
- Sanitization: No sanitization or validation of the stored memory content is mentioned, meaning instructions injected into a memory record could persist across sessions and bypass intended agent constraints.
- [NO_CODE]: The skill contains only documentation and instructional metadata in Markdown and XML-like formats; it does not include any executable scripts, binary files, or external package dependencies.
Audit Metadata