compound
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill extracts information from the active conversation to create persistent memory files, creating a surface for indirect prompt injection.
- Ingestion points: Conversations and session history (SKILL.md).
- Boundary markers: Absent. The skill does not use specific delimiters or instructions to ignore embedded commands within the extracted learnings.
- Capability inventory: The skill has file-writing and file-editing capabilities, including the ability to delete or replace text in memory files using shell commands like
grepandbash. - Sanitization: Absent. The skill does not explicitly sanitize or validate the content extracted from the session before writing it to persistent storage.
- [COMMAND_EXECUTION]: The skill uses shell commands (
bash,grep) to manage memory files, check for contradictory entries, and verify that global bridges are correctly established. These operations are limited to the user's home and project directories.
Audit Metadata