cass-memory
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill operates by executing a local command-line interface tool named
cm. It provides instructions for various subcommands including initialization (cm init), context retrieval (cm context), pattern extraction (cm reflect), and system health checks (cm doctor). - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and replay data from past sessions, which is then used to influence the agent's behavior in current tasks.
- Ingestion points: The agent ingests potentially untrusted data from the output of
cm context(rules, anti-patterns, history snippets),cm reflect(extracted patterns), andcm playbook get(rule details) as defined inSKILL.md. - Boundary markers: The instructions do not define delimiters or specific warnings to ignore instructions that might be embedded within the retrieved context or history snippets.
- Capability inventory: The agent is authorized to execute shell commands via the
cmCLI and interpret its output to inform task approaches. - Sanitization: There is no mention of sanitization, validation, or filtering of the historical data or user-contributed rules before they are re-interpolated into the agent's prompt context.
Audit Metadata