jev-memory
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill implements a persistent memory system that automatically classifies and saves sentences from user prompts as lasting preferences. These preferences are then reinjected into future sessions. This creates a risk where malicious or unintended instructions could be saved and influence future agent behavior. \n
- Ingestion points: Processes user prompts sentence-by-sentence and reads stored preferences from .claude/jev-memory.md.\n
- Boundary markers: The skill uses HTML-like tags to wrap evidence and includes a preamble instructing the model to treat the quoted text as evidence, not instructions.\n
- Capability inventory: The mod executes shell commands (via the treg CLI) and performs file write operations to .claude/jev-memory.md.\n
- Sanitization: The instructions recommend escaping characters like &, <, and > to prevent malformed tags or early escape from the evidence block.\n- [EXTERNAL_DOWNLOADS]: The skill requires downloading and installing the treg CLI from a remote site (treg.to) and cloning plugin code from the vendor's GitHub repository (github.com/superdesigndev/treg). These resources are required for the mod's core functionality.\n- [DATA_EXFILTRATION]: User prompts are sent to external infrastructure (OpenRouter) for classification. The skill provides a clear warning to the user regarding this transmission and advises against using it with sensitive data or secrets.\n- [COMMAND_EXECUTION]: The mod functions by executing the treg CLI tool via shell commands (treg --json call ...) to classify user intent.\n- [DYNAMIC_EXECUTION]: The skill provides instructions on how to generate and install a Claude Code plugin that executes dynamic logic and interacts with the host environment through shell commands and filesystem access.
Audit Metadata