persistent-memory
Pass
Audited by Gen Agent Trust Hub on May 17, 2026
Risk Level: SAFEPROMPT_INJECTIONDATA_EXFILTRATIONNO_CODE
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) because it stores and later retrieves user-provided conversation data.
- Ingestion points: Data enters the system during the extraction phase of the write pipeline in rules/write-pipeline.md.
- Boundary markers: The read pipeline in rules/read-pipeline.md surfaces the memory INDEX within markdown code blocks.
- Capability inventory: The skill performs file system read, write, move, and delete operations within designated storage roots as described in rules/storage-layout.md.
- Sanitization: The skill uses regex-based 'privacy pre-flight' checks in rules/privacy-and-consent.md and requires a mandatory user consent preview for all writes.
- [DATA_EXFILTRATION]: The skill supports a 'project-shared' storage tier that commits memory files directly to a repository's git history. This exposes potentially sensitive conversation context to all collaborators on the repository and makes the data difficult to purge due to git's immutable history.
- [NO_CODE]: This skill consists entirely of instructional Markdown files and templates. It does not execute any custom scripts or binaries, relying solely on the agent's interpretation of the provided rules and its native file system tools.
Audit Metadata