recall
Pass
Audited by Gen Agent Trust Hub on Nov 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes historical chat transcripts and shared records (issue trackers, logs) which are untrusted data sources. Malicious instructions previously entered in chat could be re-activated when the agent 'recalls' them during context reconstruction.
- Ingestion points: The skill reads local chat transcripts (JSON format) and external data from issue trackers and version control systems via the 'why' skill (SKILL.md).
- Boundary markers: The instructions do not specify the use of delimiters or explicit 'ignore' instructions when processing the content of these transcripts to prevent accidental execution of embedded commands.
- Capability inventory: The skill utilizes
gitandgh(GitHub CLI) to verify the state of branches and pull requests (SKILL.md, Step 5). - Sanitization: While the skill mandates sanitizing private context before public output, it lacks specific sanitization or escaping mechanisms for inputs to prevent injection during the internal analysis phase.
Audit Metadata