memory-fabric
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill architecture creates an attack surface for indirect prompt injection by ingesting and processing untrusted natural language observations from a knowledge graph.
- Ingestion points: Entity extraction from natural language (Step 1 in SKILL.md) and observations retrieved via
mcp__memory__search_nodes. - Boundary markers: The skill documentation defines clear result normalization and ranking logic but does not explicitly instruct the agent to use delimiters or ignore instructions embedded within graph observations.
- Capability inventory: The skill allows the
Bashtool, which could be exploited if malicious commands are stored within graph observations and executed by the agent during orchestration. - Sanitization: The skill implements semantic deduplication and normalization, though these are not primarily security-focused sanitization filters.
- [EXTERNAL_DOWNLOADS]: The skill documentation references the
@anthropic/memory-mcp-serveras a requirement for execution. This is an official package from a trusted organization used to provide the underlying memory storage capabilities.
Audit Metadata