plan-memory-hierarchy
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Python script (
scripts/bootstrap_plan_memory.py) to initialize a directory structure and write template markdown files. While the script is provided with the skill, it performs automated filesystem operations upon execution. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external markdown files within the
.plan-memory/directory to maintain context during planning phases, which could allow malicious instructions in those files to influence agent behavior. - Ingestion points: Reads content from
.plan-memory/README.md,product/requirements.md,backend/requirements.md,frontend/requirements.md, andshared/constraints.mdinSKILL.mdstep 3. - Boundary markers: Absent. The skill does not use delimiters or instructions to ignore embedded commands within the memory files.
- Capability inventory: The skill uses
scripts/bootstrap_plan_memory.pyto write and overwrite files on the local filesystem. - Sanitization: Absent. There is no evidence of filtering or escaping content read from the memory files before it is processed by the agent.
- [METADATA_POISONING]: The
SKILL.mddocumentation contains a hardcoded absolute filesystem path (/Users/kdb/.codex/skills/...) referencing the author's personal directory structure, exposing local environment metadata.
Audit Metadata