context-relay
Pass
Audited by Gen Agent Trust Hub on Aug 8, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill implements a 'file-based memory' system where the agent is instructed to treat local project files (PROJECT.md, state.json, todos.json) as its 'single source of truth'. This introduces a risk of indirect prompt injection, as malicious instructions embedded in these files could be interpreted by the agent as legitimate task parameters.
- Ingestion points: The agent reads multiple files (PROJECT.md, state.json, todos.json) during its 'Cold Start Procedure' to establish context.
- Boundary markers: No specific delimiters or safety warnings are implemented to distinguish between administrative state and potentially untrusted content within these files.
- Capability inventory: The agent uses information from these files to decide on its 'next steps' and 'current task' execution, allowing potential task manipulation.
- Sanitization: The instructions do not include steps for the agent to validate or sanitize the data read from these local files before acting upon them.
Audit Metadata