supermemory-forget
Pass
Audited by Gen Agent Trust Hub on Jul 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
nodecommand to run a local script at~/.codex/supermemory/forget-memory.js. This is the primary mechanism for the skill's functionality and is considered a standard operation for this specific toolset. - [PROMPT_INJECTION]: The skill accepts user-supplied text to describe what should be forgotten and places it directly into a command line argument. This creates a surface for indirect prompt injection or command injection if the input contains malicious shell characters. The instructions use double quotes around the placeholder as a boundary marker.
- Ingestion points: The
DESCRIPTION_OF_WHAT_TO_FORGETvariable in theSKILL.mdfile. - Boundary markers: The placeholder is enclosed in double quotes.
- Capability inventory: The skill can execute local scripts via the
Bashtool using thenoderuntime. - Sanitization: There are no specific instructions to sanitize or escape the user input before it is passed to the shell.
Audit Metadata