smart-explore

Pass

Audited by Gen Agent Trust Hub on Apr 28, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill invokes local Python scripts (vector_search.py and memory_store.py) located within the skill's own directory to perform searches and record insights. These operations are essential to its documented functionality.
  • [PROMPT_INJECTION]: The skill demonstrates an attack surface for indirect prompt injection because it incorporates data retrieved from a historical memory database into the agent's context.
  • Ingestion points: Data is ingested from the SQLite database located at ~/mnt/.claude/.cowork-mem/memory.db through the vector_search.py script.
  • Boundary markers: No specific delimiters or instructions to ignore embedded commands within retrieved data were identified in the workflow.
  • Capability inventory: The skill allows the agent to execute shell commands (via the Python scripts) and read arbitrary project files based on memory recall.
  • Sanitization: There is no evidence of sanitization or safety-filtering applied to the content retrieved from the memory database before it is used to guide the agent's exploration.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 28, 2026, 01:39 PM
Security Audit — agent-trust-hub — smart-explore