warp-delegate
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The relay.mjs script executes the oz (Warp Agent CLI) and git binaries via child_process.spawn and execFileSync. While these avoid shell interpolation, they drive a high-autonomy agent that can modify the filesystem and execute arbitrary code.
- [DATA_EXFILTRATION]: The skill documentation and relay script note that oz agent run uploads an end-of-run workspace snapshot to Warp's servers by default. This behavior can be suppressed using the --no-snapshot flag, which the skill facilitates.
- [EXTERNAL_DOWNLOADS]: The skill requires the external oz CLI to be installed and authenticated on the host system. It does not download the binary itself but relies on its presence.
- [DYNAMIC_EXECUTION]: The relay script dynamically executes a secondary script (lane.mjs) from a relative path (../../delegate-setup/scripts/lane.mjs) if the --lane option is used. This involves executing code from an external skill directory.
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes briefs and agent output. However, it includes a robust Review and Land checklist as a mitigation, requiring the orchestrator to verify all diffs and re-run project gates manually before committing changes.
Audit Metadata