agy-delegate
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The
relay.mjsscript executes theagy(Google Antigravity) andgitCLI tools usingnode:child_processmethods. This is the core mechanism for task delegation and repository monitoring. - [INDIRECT_PROMPT_INJECTION]: The skill ingests user-supplied instructions ("briefs") and passes them to the
agyimplementer. This creates a surface for indirect prompt injection, which the skill mitigates through detailed review and verification protocols. - Ingestion points:
relay.mjsreads briefs from files or standard input. - Boundary markers: The relay does not enforce delimiters, but documentation recommends XML structure for implementer tasks.
- Capability inventory: The delegated tool can write to the filesystem and execute terminal commands within the project scope.
- Sanitization: No direct sanitization is performed on brief text; instead, the skill relies on a 'review and land' workflow where the orchestrating agent verifies all changes.
- [DYNAMIC_EXECUTION]: The script may execute a local helper script (
lane.mjs) from a related skill to resolve configuration settings when the--laneoption is provided.
Audit Metadata