cognee-install
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill guides the user through installing the 'cognee' package, which is a resource provided by the author. It uses standard package managers like
uvandpip. - [SAFE]: Configuration instructions suggest using a
.envfile for API keys, which is a recommended practice for avoiding hardcoded credentials. - [INDIRECT_PROMPT_INJECTION]: The
cognee.remember()function documented in the skill ingests data from external sources (URLs, files). While this constitutes an indirect prompt injection surface, it is the primary purpose of the library and is considered safe within the context of these instructions. - Ingestion points:
cognee.remember()inSKILL.mdaccepts external data like URLs, file paths, and binary streams. - Boundary markers: None identified in the basic usage examples provided.
- Capability inventory: The library performs network calls to LLM providers and writes data to local storage (SQLite, LanceDB, and Ladybug graph).
- Sanitization: No specific sanitization or filtering methods for ingested content are described in this setup guide.
Audit Metadata