echo-sleuth — agentic threat model

Operates as a Claude Code plugin, inheriting Claude's underlying foundation model. Primary threat is indirect prompt injection via malicious content embedded in mined session histories or git repositories, potentially reprogramming the model's extraction logic.

Directly accesses highly sensitive data operations by reading local session transcripts and git history. This exposes the agent to data exfiltration risks if malicious code or secrets are present in the history, as well as data poisoning if history files are manipulated.

Orchestrates memory lifecycle management, including auditing and pruning. Vulnerabilities here include memory poisoning (injecting false 'decisions' or 'mistakes' to bias future Claude sessions) and insecure tool execution when interacting with git CLI or file systems.

Runs locally within the developer's environment as a Claude Code plugin. If compromised, it poses a threat of local privilege escalation, unauthorized file system access, or lateral movement within the developer's workstation.

Not certain from the listing — there is no mention of built-in evaluation, logging, or guardrails to monitor the plugin's memory pruning decisions, leaving potential blind spots for silent data corruption or unauthorized deletions.

Not certain from the listing — as a free, open-source plugin, it lacks explicit compliance certifications, access control policies, or formal audit trails beyond standard git history logs.

Integrates directly into the Claude Code ecosystem. A compromise of this plugin could lead to cascading failures or trust abuse, where other plugins or the main Claude agent rely on poisoned or corrupted memory states generated by echo-sleuth.