ingesting-agent-history
Pass
Audited by Gen Agent Trust Hub on Apr 4, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill operates locally by creating timestamped session summaries in the .adr/agent_ingest/ directory. It does not request network access or attempt to access sensitive system files like credentials or SSH keys.
- [PROMPT_INJECTION]: The skill identifies a surface for indirect prompt injection because it records and stores user interaction history for later re-ingestion by agents. 1. Ingestion points: Markdown files in the .adr/agent_ingest/ directory. 2. Boundary markers: The content is structured with markdown headers, but lacks explicit delimiters or instructions for future agents to ignore embedded commands. 3. Capability inventory: Agents reading these logs generally possess file system and command execution permissions. 4. Sanitization: No specific sanitization or escaping of the user-provided interaction history is performed before storage. This is documented as a functional risk inherent to context-management systems rather than a specific malicious exploit.
Audit Metadata