memory-management
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONPERSISTENCE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary purpose is to store and inject instructions ('memories') into the agent's context across sessions, creating a permanent attack surface for indirect prompt injection.
- Ingestion points: Data retrieved via mcp__claude-recall__load_rules and injected via the rule-injector hook before tool use.
- Boundary markers: Uses blocks for injection, but lacks validation for the content being injected.
- Capability inventory: The agent performs sensitive tasks like code editing and decision-making based on these injected rules.
- Sanitization: No sanitization of retrieved memories is described, allowing potentially malicious instructions to be processed as system-level reminders.
- [PERSISTENCE]: The skill establishes persistence by modifying local configuration and generating new files.
- Config modification: Instructs the user to run a setup command that modifies .claude/settings.json to register event hooks.
- File generation: Automatically creates new skill files in the .claude/skills/ directory based on accumulated data.
Audit Metadata