research-notes
Pass
Audited by Gen Agent Trust Hub on Apr 10, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill creates a surface for indirect prompt injection by storing and retrieving arbitrary user-provided content.
- Ingestion points: Untrusted data enters the skill via the title, content, and tags arguments in the create_note function within init.py.
- Boundary markers: While data is structured in Markdown and JSONL, there are no explicit prompts to the agent to ignore instructions embedded within retrieved notes.
- Capability inventory: The skill performs file system writes and reads within a dedicated memory directory (MEMORY_DIR) as seen in init.py.
- Sanitization: There is no sanitization of input strings; for instance, a title containing YAML delimiters could disrupt the formatting of the generated Markdown files.
Audit Metadata