memory
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill reads content from historical memory files and provides it directly to the agent, creating a surface for potential instruction injection.
- Ingestion points: The
memory.pyscript reads Markdown files (errors.md,context.md,files.md) from the session-specific memory directory located at~/.claude/projects/$MAX_PROJECT_ID/max/$MAX_SESSION_ID/memory/. - Boundary markers: The script prints identifying headers before displaying file content but does not use formal delimiters (like XML tags) or instructions for the agent to ignore embedded commands within the retrieved data.
- Capability inventory: The agent receiving this data typically has high-privilege capabilities, including file system access and shell command execution.
- Sanitization: There is no sanitization or validation of the retrieved content; the script prints the file text directly to the agent's context, which could allow malicious instructions stored in historical logs to be executed.
Audit Metadata