agent-memory-discipline
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines a protocol for the agent to retrieve data from long-term memory backends (such as local files, MCP servers, or hosted services) and incorporate that data into its decision-making process. This pattern introduces a vulnerability surface where malicious instructions stored in memory could be executed by the agent upon recall.
- Ingestion points: According to Step 1 in
SKILL.md, the agent retrieves context from a memory tool, a localmemory/folder, or an MCP server before acting on projects, choosing libraries, or answering user questions. - Boundary markers: The instructions do not mandate the use of delimiters, XML tags, or explicit 'ignore embedded instructions' markers to separate recalled memory content from the agent's system instructions.
- Capability inventory: The retrieved content is directly used to influence core capabilities, including tool selection, code writing, and convention enforcement as outlined in the 'Recall Before Acting' section.
- Sanitization: The skill lacks requirements for sanitizing, escaping, or validating the integrity of memory entries. Furthermore, Step 3 explicitly encourages the use of verbatim user words, which increases the risk of adversarial instructions being replayed into the agent's context.
Audit Metadata