negative-ledger

Pass

Audited by Gen Agent Trust Hub on Oct 9, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: Executes the 'ledger' CLI utility for state management, recording transactions, and performing projections (e.g., ledger transact, ledger project, ledger doctor). These operations manage the .ledger/ events log.
  • [DYNAMIC_EXECUTION]: Invokes 'uv run' to execute the 'negative_ledger_memory_note.py' script from a path calculated based on the CODEX_HOME environment variable, which handles memory admission for negative evidence.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted external data in the form of failure witnesses and implementation notes. • Ingestion points: Fields such as 'witness', 'hypothesis', 'observed_outcome', and 'falsifying_evidence' defined in capture.md and the JSON protocol schemas. • Boundary markers: Relies on JSON protocol validation (negative-evidence-protocol.json) and explicit instructions to reject 'prose-only claims' that lack structural support. • Capability inventory: Processes these records to determine future route blocking and triggers local command/script execution via the ledger tool and uv. • Sanitization: While structure is enforced via JSON, there is no explicit sanitization for descriptive text fields before they are projected back into the agent context.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 9, 2026, 05:42 AM