recall
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes historical session data stored in
~/.pi/agent/sessions/. This data represents an attack surface because past sessions might contain untrusted content (e.g., from previously read files, PR descriptions, or external API responses) that could influence the agent when 'recalled'. - Ingestion points: JSONL files located under
~/.pi/agent/sessions/--<path>--/. - Boundary markers: None specified for the historical content being read and processed.
- Capability inventory: The skill uses
grep,git,gh, and invokes subagents (scout) and other skills (research). - Sanitization: The skill contains an explicit rule to 'Redact secrets found in a session', replacing tokens, keys, and passwords with placeholders.
Audit Metadata