negative-ledger
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Executes the 'ledger' CLI utility for state management, recording transactions, and performing projections (e.g., ledger transact, ledger project, ledger doctor). These operations manage the .ledger/ events log.
- [DYNAMIC_EXECUTION]: Invokes 'uv run' to execute the 'negative_ledger_memory_note.py' script from a path calculated based on the CODEX_HOME environment variable, which handles memory admission for negative evidence.
- [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted external data in the form of failure witnesses and implementation notes. • Ingestion points: Fields such as 'witness', 'hypothesis', 'observed_outcome', and 'falsifying_evidence' defined in capture.md and the JSON protocol schemas. • Boundary markers: Relies on JSON protocol validation (negative-evidence-protocol.json) and explicit instructions to reject 'prose-only claims' that lack structural support. • Capability inventory: Processes these records to determine future route blocking and triggers local command/script execution via the ledger tool and uv. • Sanitization: While structure is enforced via JSON, there is no explicit sanitization for descriptive text fields before they are projected back into the agent context.
Audit Metadata