context-memory

Pass

Audited by Gen Agent Trust Hub on May 10, 2026

Risk Level: SAFE
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill provides an INJECT mechanism that prepends stored context to future skill calls. This represents a potential surface for indirect prompt injection if the stored data contains instructions.
  • Ingestion points: Data is loaded from ~/.claude/session_context.json and injected into the prompt context.
  • Boundary markers: No explicit markers or delimiters are defined in the instructions to separate injected context from new instructions.
  • Capability inventory: The skill manages and injects state into other tools in the environment, which could include more capable tools.
  • Sanitization: There is no description of sanitization or validation for the retrieved JSON data before interpolation.
  • [DATA_EXPOSURE_AND_EXFILTRATION]: The skill reads and writes to ~/.claude/session_context.json to maintain state across sessions. This is a local file access for session management and does not target sensitive system directories (like .ssh or .aws) or involve network exfiltration.
Audit Metadata
Risk Level
SAFE
Analyzed
May 10, 2026, 12:54 AM
Security Audit — agent-trust-hub — context-memory