xray

Warn

Audited by Gen Agent Trust Hub on Jun 18, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses user-supplied arguments to construct file paths for shell commands, such as ls "$MEMORY_DIR"/*<name>*.md and mv. If a user provides input containing shell metacharacters (e.g., semicolons, backticks, or pipes), it could lead to arbitrary command execution on the host system.
  • [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface because it reads and displays the contents of memory files from $HOME/.claude/projects/ which are populated with data from various external sources during agent interactions. 1. Ingestion points: Markdown files in the project memory directory. 2. Boundary markers: No explicit delimiters or instructions are present to prevent the agent from executing instructions found within the data. 3. Capability inventory: The skill utilizes shell commands for file listing, reading, and moving. 4. Sanitization: Memory file content is not sanitized or escaped before being processed in the agent context.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Jun 18, 2026, 01:15 PM
Security Audit — agent-trust-hub — xray