memory
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides a surface for indirect prompt injection by automatically ingesting "distilled knowledge" (memories) from a shared store (~/.helix/memory) that can be populated by other users or agents.
- Ingestion points: Memories are automatically injected into the agent's context at session start, when working on specific file paths, and via the
memory searchandmemory recallcommands described inSKILL.md. - Boundary markers: The instructions do not define explicit boundary markers or warnings to the agent to ignore instructions that might be embedded within the recalled memory content.
- Capability inventory: The skill utilizes
BashandPowerShelltools to interact with a specializedhelixbinary, which performs file system operations and can start a local web server for memory management (SKILL.md). - Sanitization: The skill relies on "human-gated promotion" and provenance tracking rather than technical sanitization or filtering of the memory content to prevent malicious instructions from influencing the agent.
Audit Metadata