agent-memory-systems
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill describes systems for ingesting and storing external data such as messages, facts, and episodes, which creates an attack surface for indirect prompt injection if the stored data is later retrieved and processed by an agent without proper sanitization.
- Ingestion points: The skill defines multiple ingestion points where untrusted data enters the agent context, specifically
WorkingMemoryManager.addMessage(lines 62-72),ShortTermStore.addFact(lines 118-125),EpisodicMemory.remember(lines 149-156), andSemanticMemory.learn(lines 182-197) inSKILL.md. - Boundary markers: The provided implementation snippets lack boundary markers. The
getContextmethod (lines 78-85) andcontextualRetrievalfunction (lines 280-293) interpolate stored data directly into prompt strings without using delimiters or instructions to ignore embedded commands. - Capability inventory: The snippets demonstrate interactions with vector stores, Redis, and JSON parsing, but do not include high-risk capabilities such as shell execution, subprocess calls, or arbitrary file-system writes.
- Sanitization: No sanitization, validation, or escaping logic is present in the examples for the content being stored or retrieved.
Audit Metadata