agent-manager

Pass

Audited by Gen Agent Trust Hub on Sep 21, 2026

Risk Level: SAFEPERSISTENCECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [PERSISTENCE]: The skill provides commands (schedule sync and heartbeat sync) that write configurations to the user's system crontab. This mechanism is used to enable recurring agent tasks and periodic heartbeat check-ins.
  • [COMMAND_EXECUTION]: The skill manages agent processes by executing commands within tmux sessions. It supports the execution of various 'launchers' (e.g., the claude CLI or custom scripts) and allows sending raw strings and control characters to interactive shell sessions.
  • [EXTERNAL_DOWNLOADS]: The scripts/install.sh script facilitates the installation of the skill by cloning source code from a GitHub repository (github.com/fractalmind-ai/agent-manager-skill) and utilizing npx openskills for automated setup.
  • [INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface due to its ingestion and processing of external data.
  • Ingestion points: Agent configurations are read from YAML frontmatter in agents/EMP_*.md files. Additionally, the assign command accepts task data from standard input or external files via the --task-file argument.
  • Boundary markers: No explicit delimiters or boundary markers for untrusted data are visible in the documented command structure.
  • Capability inventory: The skill possesses extensive capabilities including file system read/write access, tmux session manipulation, subprocess execution, and modification of system cron jobs.
  • Sanitization: There is no evidence of specific sanitization or validation of input strings before they are interpolated into process commands or agent prompts.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 21, 2026, 10:23 PM