managing-people
Pass
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a local CLI tool
manager-os memoryto perform file operations and database queries across several directories. - [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (Category 8) due to the way it handles untrusted data from its knowledge graph.
- Ingestion points: Data is retrieved from memory files and the knowledge graph via
manager-os memory recallandmanager-os memory read(SKILL.md). - Boundary markers: Absent. There are no defined delimiters or instructions to the agent to treat retrieved memory content as potentially untrusted data.
- Capability inventory: The agent has capabilities to modify the knowledge graph and file system using
manager-os memory write,manager-os memory remember,manager-os memory relate, andmanager-os memory logcommands. - Sanitization: No sanitization or validation of content retrieved from the
manager-ossystem is specified, allowing embedded instructions in notes to influence agent behavior.
Audit Metadata