warp-delegate
Pass
Audited by Gen Agent Trust Hub on Aug 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The relay.mjs script executes the oz (Warp Agent CLI) and git binaries using array-based arguments and avoids shell execution, which prevents command injection into the relay process itself.
- [REMOTE_CODE_EXECUTION]: The skill allows an AI agent to execute commands on the host machine via the oz agent run command. The documentation explicitly warns that this environment is not sandboxed and runs with the user's permissions, necessitating a human-in-the-loop 'Review and Land' process to verify changes.
- [DATA_EXFILTRATION]: The oz tool uploads workspace snapshots to Warp's servers by default. This is a documented feature of the external tool, and the skill provides a --no-snapshot flag to disable this behavior.
- [PROMPT_INJECTION]: The skill accepts a 'brief' (text prompt) from the orchestrator and passes it to the oz agent, presenting an indirect prompt injection surface.
- Ingestion points: The relay.mjs script reads the brief from a file or stdin.
- Boundary markers: No technical boundary markers are enforced on the input brief, though the documentation recommends a structured report contract.
- Capability inventory: The skill can read/write files and execute arbitrary shell commands via the oz agent.
- Sanitization: The script validates several flags against an alphanumeric regex and prevents flag injection for others by checking for leading hyphens.
Audit Metadata