agent-manager
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEPERSISTENCECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PERSISTENCE]: The skill provides commands (
schedule syncandheartbeat sync) that write configurations to the user's systemcrontab. This mechanism is used to enable recurring agent tasks and periodic heartbeat check-ins. - [COMMAND_EXECUTION]: The skill manages agent processes by executing commands within
tmuxsessions. It supports the execution of various 'launchers' (e.g., theclaudeCLI or custom scripts) and allows sending raw strings and control characters to interactive shell sessions. - [EXTERNAL_DOWNLOADS]: The
scripts/install.shscript facilitates the installation of the skill by cloning source code from a GitHub repository (github.com/fractalmind-ai/agent-manager-skill) and utilizingnpx openskillsfor automated setup. - [INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface due to its ingestion and processing of external data.
- Ingestion points: Agent configurations are read from YAML frontmatter in
agents/EMP_*.mdfiles. Additionally, theassigncommand accepts task data from standard input or external files via the--task-fileargument. - Boundary markers: No explicit delimiters or boundary markers for untrusted data are visible in the documented command structure.
- Capability inventory: The skill possesses extensive capabilities including file system read/write access,
tmuxsession manipulation, subprocess execution, and modification of system cron jobs. - Sanitization: There is no evidence of specific sanitization or validation of input strings before they are interpolated into process commands or agent prompts.
Audit Metadata