aimem
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions for using standard Linux utilities (findmnt, mount, getfattr, ls, cat, echo) and the vendor-specific aimem CLI to interact with the workspace. These commands are used for their intended administrative and navigational purposes.\n- [DATA_EXPOSURE_AND_EXFILTRATION]: The documentation discusses accessing S3 metadata and tags as extended attributes. It follows security best practices by explicitly advising against storing secrets or credentials on the mount, recommending the use of environment variables instead.\n- [INDIRECT_PROMPT_INJECTION]: The skill defines a surface for processing data from a remote S3 bucket, which may contain instructions from other agents or external sources.\n
- Ingestion points: File contents on the mount, object annotations under the .aimem/annot/ path, and S3 metadata/tags exposed via xattrs in references/annotations.md and references/metadata.md.\n
- Boundary markers: The instructions do not specify the use of delimiters or 'ignore' instructions when reading content from the mount.\n
- Capability inventory: The skill utilizes shell command execution (aimem, findmnt, getfattr), file system writes, and server-side search capabilities across all files.\n
- Sanitization: There is no mention of sanitizing or validating the data retrieved from the remote store before processing.
Audit Metadata