domain-analysis
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
- [PERSISTENCE]: The skill is designed to maintain state across sessions by writing record data to a plugin store at
${CLAUDE_PLUGIN_DATA}/records/and an optional user-defined mirror folder${user_config.records_mirror}. It retrieves and resumes these records in subsequent runs to extend existing models.\n- [INDIRECT_PROMPT_INJECTION]: The skill resumes runs by reading and processing instructions or data from previously saved JSONL records. A compromised record file could be used to inject instructions that influence the agent's behavior during a resume operation.\n - Ingestion points: Records are read from
${CLAUDE_PLUGIN_DATA}/records/and${user_config.records_mirror}as specified inSKILL.md.\n - Boundary markers: The instructions do not define specific delimiters or instructions for the agent to ignore potentially malicious content embedded within the records.\n
- Capability inventory: The skill performs file reading, file appending, and directory creation as part of its documented workflow in
SKILL.md.\n - Sanitization: No validation or sanitization of the record content is performed before the agent processes and acts upon the resumed data.
Audit Metadata