{"data":{"skill":{"slug":"sickn33-conversation-memory","name":"conversation-memory","icon":"📦","repo":"https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/conversation-memory","status":"approved","author":"sickn33","authorVersion":null,"skillstoreRevision":2},"audit":{"id":"6a65105f-2b05-4999-a87d-357e7d495c5d","skill_id":"bdf73d24-efa0-48c3-b5fe-96f5733f27fd","version":5,"content_hash":"v3:f9e2c34b4f19c7f3e6b0a1e93227b5f77cc12526:d21d163c2a4124c403ab4dffede543cedc14fd3fe06ffeb9eb3394da33520d81:711faa091d931a0137497f378b7c7b589cb7e69c4c5e1fb1f19768313df5e848:736b696c6c732f7369636b6e33332f636f6e766572736174696f6e2d6d656d6f7279:49d81ff29901a5f4ef7e2e9313ec1f9e","risk_level":"high","is_blocked":false,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":"confirmation_required","manual_install_policy":"allowed","summary":"All 14 static findings are false positives caused by JavaScript template literals, Markdown backticks, and ordinary exception handling. However, examples directly interpolate untrusted messages and recalled memories into prompts, creating a persistent prompt-injection risk.","remediation":[{"issue":"Untrusted messages and stored memories are inserted directly into model prompts.","severity":"high","suggestion":"Treat recalled content as untrusted data, delimit it clearly, filter instruction-like content, track provenance, and validate model-generated extraction before persistence."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":102,"line_start":102},{"file":"SKILL.md","line_end":109,"line_start":109},{"file":"SKILL.md","line_end":152,"line_start":145},{"file":"SKILL.md","line_end":218,"line_start":214},{"file":"SKILL.md","line_end":219,"line_start":219},{"file":"SKILL.md","line_end":222,"line_start":220},{"file":"SKILL.md","line_end":223,"line_start":223},{"file":"SKILL.md","line_end":231,"line_start":224},{"file":"SKILL.md","line_end":348,"line_start":343},{"file":"SKILL.md","line_end":384,"line_start":384},{"file":"SKILL.md","line_end":483,"line_start":478},{"file":"SKILL.md","line_end":487,"line_start":483},{"file":"SKILL.md","line_end":487,"line_start":487}]}],"critical_findings":[],"high_findings":[{"title":"Persistent Prompt Injection Through Untrusted Memory","locations":[{"file":"SKILL.md","line_end":152,"line_start":145},{"file":"SKILL.md","line_end":231,"line_start":214}],"confidence":0.93,"description":"Examples interpolate messages and recalled memories directly into prompts without trust labeling or instruction filtering. Attackers could store directives that influence later model behavior.","review_kind":"security","source_category":"semantic","source_severity":"high","confidence_reasoning":"The examples visibly interpolate message, entity, and memory content into LLM prompts without a trust boundary. Persistence makes injected instructions reusable across sessions."}],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":500,"audit_model":"codex","audited_at":"2026-07-23T21:27:34.004+00:00","created_at":"2026-07-26T07:23:17.616217+00:00","static_findings":[{"id":"external_commands:SKILL.md:102:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"longTermRelevant.map(m => `- ${m.content}`).join('\\n'));","category":"external_commands","line_end":102,"severity":"medium","line_start":102},{"id":"external_commands:SKILL.md:109:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"entities.map(e => `- ${e.name}: ${e.facts.join(', ')}`).join('\\n'));","category":"external_commands","line_end":109,"severity":"medium","line_start":109},{"id":"external_commands:SKILL.md:145:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"const extraction = await llm.complete(`","category":"external_commands","line_end":152,"severity":"medium","line_start":145},{"id":"external_commands:SKILL.md:214:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"const prompt = `","category":"external_commands","line_end":218,"severity":"medium","line_start":214},{"id":"external_commands:SKILL.md:219:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`- ${e.name}: ${e.facts.map(f => f.content).join('; ')}`","category":"external_commands","line_end":219,"severity":"medium","line_start":219},{"id":"external_commands:SKILL.md:220:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":").join('\\n')}` : ''}","category":"external_commands","line_end":222,"severity":"medium","line_start":220},{"id":"external_commands:SKILL.md:223:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`- [${formatDate(m.timestamp)}] ${m.content}`","category":"external_commands","line_end":223,"severity":"medium","line_start":223},{"id":"external_commands:SKILL.md:224:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":").join('\\n')}` : ''}","category":"external_commands","line_end":231,"severity":"medium","line_start":224},{"id":"external_commands:SKILL.md:343:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"const relevanceScore = await llm.complete(`","category":"external_commands","line_end":348,"severity":"medium","line_start":343},{"id":"external_commands:SKILL.md:384:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"return `user:${userId}:memory:${memoryId}`;","category":"external_commands","line_end":384,"severity":"medium","line_start":384},{"id":"external_commands:SKILL.md:478:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":483,"severity":"medium","line_start":478},{"id":"external_commands:SKILL.md:483:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":487,"severity":"medium","line_start":483},{"id":"external_commands:SKILL.md:487:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Works well with: `context-window-management`, `rag-implementation`, `prompt-caching`, `llm-npc-dialo","category":"external_commands","line_end":487,"severity":"medium","line_start":487},{"id":"blocker:SKILL.md:390:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"throw new Error('Invalid user ID');","category":"blocker","line_end":390,"severity":"low","line_start":390}],"finding_verdicts":[{"id":"external_commands:SKILL.md:102:ruby-shell-backtick-execution","reason":"Line 102 uses a JavaScript template literal to format memory content. It does not invoke a shell or external process.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:109:ruby-shell-backtick-execution","reason":"Line 109 uses a JavaScript template literal to format entity facts. No command execution API or shell invocation is present.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:145:ruby-shell-backtick-execution","reason":"Lines 145-152 create a multiline JavaScript string for an LLM call. The backticks do not execute an operating-system command.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:214:ruby-shell-backtick-execution","reason":"Lines 214-218 begin a JavaScript prompt template. This is string construction, not shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:219:ruby-shell-backtick-execution","reason":"Line 219 formats entity data inside a nested JavaScript template literal. It does not launch a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:220:ruby-shell-backtick-execution","reason":"Lines 220-222 close and join JavaScript template expressions used to build a prompt. No external command interface appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:223:ruby-shell-backtick-execution","reason":"Line 223 formats a dated memory entry with a JavaScript template literal. The value remains plain text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:224:ruby-shell-backtick-execution","reason":"Lines 224-231 complete a JavaScript prompt string. There is no shell, process, or subprocess call.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:343:ruby-shell-backtick-execution","reason":"Lines 343-348 construct an LLM relevance-scoring prompt with a JavaScript template literal. This does not execute a system command.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:384:ruby-shell-backtick-execution","reason":"Line 384 creates a namespaced storage key using JavaScript interpolation. It has no command-execution behavior.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:478:ruby-shell-backtick-execution","reason":"Line 478 is a Markdown code-fence delimiter. It cannot execute a command.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:483:ruby-shell-backtick-execution","reason":"Line 483 closes a Markdown code fence. It is documentation syntax only.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:487:ruby-shell-backtick-execution","reason":"Line 487 uses Markdown inline-code formatting around related skill names. It does not invoke those skills or any external command.","verdict":"false_positive","confidence":1},{"id":"blocker:SKILL.md:390:system-reconnaissance","reason":"Line 390 throws an error after user-ID validation fails. It performs no system discovery or reconnaissance.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[{"title":"Persistent Prompt Injection Through Untrusted Memory","severity":"high","locations":[{"file":"SKILL.md","line_end":152,"line_start":145},{"file":"SKILL.md","line_end":231,"line_start":214}],"confidence":0.93,"description":"Examples interpolate messages and recalled memories directly into prompts without trust labeling or instruction filtering. Attackers could store directives that influence later model behavior.","confidence_reasoning":"The examples visibly interpolate message, entity, and memory content into LLM prompts without a trust boundary. Persistence makes injected instructions reusable across sessions."}],"subject_marketplace_commit_sha":"f9e2c34b4f19c7f3e6b0a1e93227b5f77cc12526","subject_content_hash":"d21d163c2a4124c403ab4dffede543cedc14fd3fe06ffeb9eb3394da33520d81","subject_tree_hash":"711faa091d931a0137497f378b7c7b589cb7e69c4c5e1fb1f19768313df5e848","subject_plugin_path":"skills/sickn33/conversation-memory","audit_payload_hash":"49d81ff29901a5f4ef7e2e9313ec1f9e","confirmed_risk_level":"high","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"f9e2c34b4f19c7f3e6b0a1e93227b5f77cc12526","contentHash":"d21d163c2a4124c403ab4dffede543cedc14fd3fe06ffeb9eb3394da33520d81","treeHash":"711faa091d931a0137497f378b7c7b589cb7e69c4c5e1fb1f19768313df5e848","pluginPath":"skills/sickn33/conversation-memory","auditPayloadHash":"49d81ff29901a5f4ef7e2e9313ec1f9e"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/sickn33-conversation-memory/audits/5/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"high","confirmedFindingCount":1,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"confirmation_required","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}