memory-capture
Warn
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: MEDIUMPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [PROMPT_INJECTION] (MEDIUM): Indirect Prompt Injection via Session Poisoning.\n
- Ingestion points:
phases/01-compact.mdextracts content (Execution Plan, Decisions, Notes) directly from conversation history.\n - Boundary markers: Uses Markdown headers and
<details>tags, which are insufficient to prevent an LLM from interpreting data as instructions.\n - Capability inventory: Utilizes
mcp__ccw-tools__core_memoryfor persistent storage andRead(*)for filesystem access, creating a mechanism where persisted malicious instructions influence future agent behavior.\n - Sanitization: None. Instructions explicitly mandate that the agent 'preserve COMPLETE plan verbatim' and 'never abbreviate', ensuring malicious payloads remain intact.\n- [DATA_EXFILTRATION] (MEDIUM): Exposure of sensitive environment metadata. The skill collects absolute file system paths (
projectRoot), list of modified files, and organizational decisions, aggregating sensitive environment information incore_memory.\n- [COMMAND_EXECUTION] (LOW): Tool Permission Mismatch. The execution phases attempt to usemcp__ccw-tools__session_manager, which is not declared in theallowed-toolssection ofSKILL.md, indicating a potential bypass of intended tool access constraints.
Audit Metadata