load
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes data retrieved from external memory stores via the Serena MCP interface. While this is the intended functionality for context loading, data stored in these memories could theoretically contain instructions meant to influence the agent.
- Ingestion points: Data is loaded via list_memories and subsequent tool calls to read memory keys defined in SKILL.md.
- Boundary markers: The instructions do not specify delimiters or warnings for the agent to ignore instructions embedded within the loaded memory data.
- Capability inventory: The skill provides instructions for mapping high-privilege tools such as Bash, Write, and WebSearch for Codex and Cursor environments, though it does not execute them directly.
- Sanitization: There is no explicit logic to validate or sanitize the content of the loaded memories before they are integrated into the agent's context.
Audit Metadata