aider-delegate
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The
relay.mjsscript manages the lifecycle of theaiderCLI andgitprocesses. It utilizesspawnandexecFileSyncto run these tools andtaskkill(on Windows) orprocess.kill(on POSIX) to ensure clean termination of process groups. - [DYNAMIC_EXECUTION]: The
relay.mjsscript dynamically constructs the path to a sibling configuration script (../../delegate-setup/scripts/lane.mjs) and executes it usingspawnSyncwhen the--laneoption is used. This allows for modular configuration resolution within the toolset. - [EXTERNAL_DOWNLOADS]: The skill relies on the
aider-chatpackage, which is a well-known tool. The documentation guides the user to install it via standard package managers. Aider naturally connects to external AI model providers (such as OpenAI or Anthropic) or local API endpoints to perform its tasks. - [INDIRECT_PROMPT_INJECTION]: The skill processes task briefs and codebase content through the Aider implementer, which creates a potential surface for indirect prompt injection. A malicious file in the repository could attempt to influence Aider's output. The skill explicitly mitigates this by enforcing a manual diff review and gate verification process before code is committed.
- Ingestion points: Task briefs provided via file or stdin, and the repository files Aider reads into its context.
- Boundary markers: The documentation recommends a structured brief format using headers like GOAL, CONTEXT, and DO NOT TOUCH in
references/writing-the-brief.md. - Capability inventory: The skill facilitates file system modifications and execution of project test/lint suites (gates) through Aider in
scripts/relay.mjs. - Sanitization: No automated sanitization of the brief is performed; the system relies on the mandatory human review of the generated diffs as the primary gate.
Audit Metadata