heartbeat
Pass
Audited by Gen Agent Trust Hub on May 20, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill functions as a local task orchestrator. File operations are limited to reading and writing task state in the .agent/state/ directory. No network access, remote downloads, or persistence mechanisms were detected.
- [COMMAND_EXECUTION]: The script scripts/heartbeat.py calls subprocess.check_output with the command git rev-parse --show-toplevel. This call is used exclusively to find the repository root. The command is hardcoded and does not interpolate user input, making it safe.
- [PROMPT_INJECTION]: As an orchestrator, the skill identifies a vulnerability surface for indirect prompt injection by processing task descriptions from a shared queue file. 1. Ingestion points: Data is read from .agent/state/tasks.json within scripts/heartbeat.py and SKILL.md. 2. Boundary markers: Absent. No delimiters or instructions are provided to the agent to ignore potentially malicious content within task descriptions. 3. Capability inventory: The skill instructs the agent to use other available skills to execute tasks; heartbeat.py uses subprocess for environment discovery. 4. Sanitization: Absent. Content from the task queue is not sanitized before being presented to the agent.
Audit Metadata