compact-memory-implementation

Pass

Audited by Gen Agent Trust Hub on Jun 22, 2026

Risk Level: SAFEPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
  • [PROMPT_INJECTION]: The skill facilitates indirect prompt injection by design through its memory compaction architecture.\n
  • Ingestion points: User conversation history is ingested via format_history_for_compact in SKILL.md and through session JSONL files in scripts/pre_compact_extract.py.\n
  • Boundary markers: The MEMORY_BLOCK_TEMPLATE used in SKILL.md to restore memory into the system prompt lacks clear delimiters or explicit instructions for the agent to ignore embedded commands within the compacted data.\n
  • Capability inventory: The skill's architecture involves writing to local files (memory/*.json) and calling the Anthropic API to generate summaries and responses.\n
  • Sanitization: There is no evidence of sanitization or escaping of user-provided content before it is processed by the compactor model or subsequently injected into the main agent's system prompt.\n- [DATA_EXFILTRATION]: The script scripts/pre_compact_extract.py accesses potentially sensitive local data.\n
  • Evidence: The script is designed to search for and read JSONL session files located in ~/.claude/projects/. These files contain full logs of user-agent interactions. While the script's purpose is to assist developers in managing session memory, this behavior constitutes access to sensitive local information.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 22, 2026, 05:03 AM
Security Audit — agent-trust-hub — compact-memory-implementation