cognee-install

Pass

Audited by Gen Agent Trust Hub on Oct 18, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [SAFE]: The skill guides the user through installing the 'cognee' package, which is a resource provided by the author. It uses standard package managers like uv and pip.
  • [SAFE]: Configuration instructions suggest using a .env file for API keys, which is a recommended practice for avoiding hardcoded credentials.
  • [INDIRECT_PROMPT_INJECTION]: The cognee.remember() function documented in the skill ingests data from external sources (URLs, files). While this constitutes an indirect prompt injection surface, it is the primary purpose of the library and is considered safe within the context of these instructions.
  • Ingestion points: cognee.remember() in SKILL.md accepts external data like URLs, file paths, and binary streams.
  • Boundary markers: None identified in the basic usage examples provided.
  • Capability inventory: The library performs network calls to LLM providers and writes data to local storage (SQLite, LanceDB, and Ladybug graph).
  • Sanitization: No specific sanitization or filtering methods for ingested content are described in this setup guide.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 18, 2026, 08:44 AM