agy-delegate

Pass

Audited by Gen Agent Trust Hub on Sep 13, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The relay.mjs script executes the agy (Google Antigravity) and git CLI tools using node:child_process methods. This is the core mechanism for task delegation and repository monitoring.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests user-supplied instructions ("briefs") and passes them to the agy implementer. This creates a surface for indirect prompt injection, which the skill mitigates through detailed review and verification protocols.
  • Ingestion points: relay.mjs reads briefs from files or standard input.
  • Boundary markers: The relay does not enforce delimiters, but documentation recommends XML structure for implementer tasks.
  • Capability inventory: The delegated tool can write to the filesystem and execute terminal commands within the project scope.
  • Sanitization: No direct sanitization is performed on brief text; instead, the skill relies on a 'review and land' workflow where the orchestrating agent verifies all changes.
  • [DYNAMIC_EXECUTION]: The script may execute a local helper script (lane.mjs) from a related skill to resolve configuration settings when the --lane option is provided.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 13, 2026, 11:32 PM
Security Audit — agent-trust-hub — agy-delegate