context-memory
Pass
Audited by Gen Agent Trust Hub on May 10, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides an INJECT mechanism that prepends stored context to future skill calls. This represents a potential surface for indirect prompt injection if the stored data contains instructions.
- Ingestion points: Data is loaded from ~/.claude/session_context.json and injected into the prompt context.
- Boundary markers: No explicit markers or delimiters are defined in the instructions to separate injected context from new instructions.
- Capability inventory: The skill manages and injects state into other tools in the environment, which could include more capable tools.
- Sanitization: There is no description of sanitization or validation for the retrieved JSON data before interpolation.
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill reads and writes to ~/.claude/session_context.json to maintain state across sessions. This is a local file access for session management and does not target sensitive system directories (like .ssh or .aws) or involve network exfiltration.
Audit Metadata