crossmem-loader
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest external data which creates a surface for indirect prompt injection.
- Ingestion points: The
crossmem load --session <ref> --fullcommand (SKILL.md) reads raw conversation transcripts from various agent tools into the current session. - Boundary markers: The skill mentions markers like
[... middle of the session elided ...]and instructions to ignore harness boilerplate, but lacks robust machine-enforced delimiters between historical content and the current instruction stream. - Capability inventory: The skill provides access to several CLI operations including
crossmem list,load,update,export,import, andconfig(SKILL.md, references/troubleshooting.md). - Sanitization: The instructions tell the agent to manually "filter noise" and synthesize a brief, which relies on the LLM's adherence to instructions rather than technical sanitization of the input.
- [COMMAND_EXECUTION]: The skill requires the agent to execute a variety of subcommands through the
crossmemCLI tool to list sessions, load context, and manage configurations.
Audit Metadata