craft-skills-and-memories
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the creation and modification of persistent agent instructions and memories based on user input, creating a potential surface for indirect prompt injection.
- Ingestion points: User-provided lessons and reports of skill misbehavior are processed into permanent instructions like
SKILL.mdand memory files. - Boundary markers: The instructions emphasize documentation structure but do not define specific cryptographic or hard delimiters to isolate user-provided data from the agent's logic.
- Capability inventory: The agent is empowered to read and edit files, including its own instructions and scripts (
.codex-plugin/plugin.json). - Sanitization: No explicit instructions for sanitizing or validating user-provided specimens are provided.
- [DYNAMIC_EXECUTION]: The skill instructs the agent to fix failing scripts and validate the changes by running repository checks, which involves executing dynamically modified code.
- Pattern: The agent is directed to fix 'mechanical failures' in scripts and subsequently 'run the gates' where they exist to confirm the fix (
SKILL.md).
Audit Metadata