lov-search-chat
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/ataru_recall.pyexecutes the localatarubinary to query the memory index. It resolves the binary path by checking theATARU_BINenvironment variable, searching the system PATH, looking in common macOS application bundles, and searching the current working directory. The script uses version gating (requiring version 0.41.3+) to ensure compatibility and prevent unintended behavior with older versions. - [INDIRECT_PROMPT_INJECTION]: The skill ingests past conversation transcripts which may contain malicious instructions embedded in the historical data. This risk is inherent to the skill's purpose of context recall. It is mitigated by:
- Ingestion points: Transcripts are read via the Ataru CLI in
ataru_recall.py. - Boundary markers: Output is structured as JSON with explicit metadata fields.
- Capability inventory: The skill has local command execution and file system access capabilities.
- Sanitization: Content is automatically truncated (default 600 characters for snippets and 2000 for full messages) and appended with character count warnings to prevent large-scale context poisoning.
Audit Metadata