agentic-os
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEPERSISTENCEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PERSISTENCE]: The skill includes configuration templates for LaunchAgents (macOS), systemd timers (Linux), and pm2 to ensure Claude Code processes remain persistent in the background across sessions and system restarts.
- [INDIRECT_PROMPT_INJECTION]: The architecture establishes a vulnerability surface where untrusted data could influence agent behavior.
- Ingestion points: Agent definitions and routing rules ingest data from directories like
data/inbox/anddata/logs/. - Boundary markers: Absent; there are no instructions to agents to ignore or delimit embedded instructions in the processed files.
- Capability inventory: The framework grants agents extensive permissions including full filesystem access, Git operations, and execution of configured MCP servers.
- Sanitization: Absent; the skill does not include mechanisms for filtering or validating external input before processing.
- [COMMAND_EXECUTION]: Agent instructions explicitly grant broad authority, such as 'Full filesystem access within project root' and 'Git operations (status, diff, commit, branch)', which could be misused if the agent processes malicious input.
Audit Metadata