memory-to-skill
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from past session transcripts and journals to generate new agent skills. This process is susceptible to indirect prompt injection, where adversarial instructions embedded in historical data could be incorporated into a new, persistent skill.
- Ingestion points: Conversation transcripts and memory journals stored in the .memsearch/memory/ directory.
- Boundary markers: The instructions do not specify any markers to delimit or ignore potentially malicious instructions within the historical data.
- Capability inventory: The skill uses vendor-specific commands to write content to a candidate store (.memsearch/skill-candidates/) and install skills to active execution directories like .claude/skills or .agents/skills.
- Sanitization: The instructions recommend avoiding secrets and using imperative steps, but there is no automated sanitization of the extracted content. The process includes a mandatory human review step before installation, which serves as a primary mitigation.
Audit Metadata