compact-memory-implementation
Pass
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: SAFEPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [PROMPT_INJECTION]: The skill facilitates indirect prompt injection by design through its memory compaction architecture.\n
- Ingestion points: User conversation history is ingested via
format_history_for_compactinSKILL.mdand through session JSONL files inscripts/pre_compact_extract.py.\n - Boundary markers: The
MEMORY_BLOCK_TEMPLATEused inSKILL.mdto restore memory into the system prompt lacks clear delimiters or explicit instructions for the agent to ignore embedded commands within the compacted data.\n - Capability inventory: The skill's architecture involves writing to local files (
memory/*.json) and calling the Anthropic API to generate summaries and responses.\n - Sanitization: There is no evidence of sanitization or escaping of user-provided content before it is processed by the compactor model or subsequently injected into the main agent's system prompt.\n- [DATA_EXFILTRATION]: The script
scripts/pre_compact_extract.pyaccesses potentially sensitive local data.\n - Evidence: The script is designed to search for and read JSONL session files located in
~/.claude/projects/. These files contain full logs of user-agent interactions. While the script's purpose is to assist developers in managing session memory, this behavior constitutes access to sensitive local information.
Audit Metadata