folded-memory-implementation
Pass
Audited by Gen Agent Trust Hub on Jul 6, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The memory compaction and distillation logic is vulnerable to indirect prompt injection from conversation history.
- Ingestion points: Raw user conversation turns are ingested by the
compact_l1_to_episodeanddistill_episodes_to_semanticfunctions inSKILL.md. - Boundary markers: The prompt templates
EPISODE_COMPACTOR_PROMPTandSEMANTIC_EXTRACTOR_PROMPTdo not utilize delimiters or specific instructions to ignore malicious directives embedded in the text being summarized. - Capability inventory: The skill provides logic to persist this potentially poisoned memory to the local filesystem via
save_folded_memoryinSKILL.md. - Sanitization: There is no evidence of sanitization or filtering of the conversation turns before they are processed by the LLM for memory folding.
- [EXTERNAL_DOWNLOADS]: The README.md file contains instructions to install the skill using
npx skills add, which fetches content from the author's repository.
Audit Metadata