remembering-conversations
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEPROMPT_INJECTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill instructions employ aggressive and mandatory language intended to override the agent's default behavior and prioritization. The description and body use directives such as "ALWAYS USE THIS SKILL... NO MATTER HOW TRIVIAL" and "YOU MUST dispatch the search-conversations agent," which are common patterns for behavioral manipulation and forcing reliance on specific skill logic.\n- [INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection because it is designed to ingest and synthesize data from historical conversations.\n
- Ingestion points: Data retrieved via the
search-conversationsagent and MCP memory tools (mcp__plugin_episodic-memory_episodic-memory__search,mcp__plugin_episodic-memory_episodic-memory__show) inSKILL.md.\n - Boundary markers: There are no instructions for the agent to wrap historical data in delimiters or warnings to ignore embedded instructions within that data.\n
- Capability inventory: The agent is tasked with synthesizing findings and generating "actionable insights" based on retrieved content.\n
- Sanitization: The skill does not implement sanitization or validation for the content pulled from episodic memory.
Audit Metadata