fleet-worker
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill is designed to wrap and execute the
claudeCLI binary to spawn worker processes. These workers are provided with access to powerful tools such asBash,Read,Write, andEdit, which are necessary for the skill's primary purpose of automating coding tasks. - [INDIRECT_PROMPT_INJECTION]: The skill implements an architecture where agents process natural language prompts to drive tool-using workflows.
- Ingestion points: Prompts are ingested as command-line arguments or via standard input in the
scripts/fleet-workerlauncher. - Boundary markers: The launcher passes the prompt directly to the underlying agent without implementing specific delimiters or 'ignore previous instructions' boundary markers.
- Capability inventory: The spawned workers possess a full tool harness including shell access (
Bash), file manipulation (Write,Edit), and system exploration (Read,Glob,Grep). - Sanitization: The skill does not perform sanitization or filtering on the provided prompts before passing them to the agent for execution.
- [EXTERNAL_DOWNLOADS]: The
scripts/fleet-doctor.shdiagnostic tool performs an active health check by sending a request to the configured Anthropic-compatible endpoint (defaulting toapi.z.ai). This is used to verify model availability and API key validity during preflight setup.
Audit Metadata