design-memory
Pass
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill implements a persistent 'design memory' system that ingests data from local files, which serves as a potential vector for indirect prompt injection.
- Ingestion points: The agent is instructed to read content from multiple files in the
.sumi/directory, includingstyle.json,brief.json,map.json,vision.json,wireframe-*.json,generated-*.json, anddecisions.log(referenced inSKILL.mdandreferences/sumi-file-schemas.md). - Boundary markers: Absent. The instructions do not specify the use of delimiters or 'ignore embedded instructions' warnings when the agent processes the content of these design memory files.
- Capability inventory: The skill describes operations for reading, modifying (deep-merging), and writing JSON and NDJSON files to the local file system.
- Sanitization: Absent. While the skill enforces a specific JSON schema to prevent 'clobbering' between commands, it does not define validation or sanitization logic for natural language fields (such as
meta.mood,tone.traits, ordecisions.logentries) that could contain malicious instructions.
Audit Metadata