sync-agent-setups
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-authored behavioral setups, such as custom skills, hooks, and workflows, and syncs them to other agents. This facilitates the propagation of potential injection attacks or malicious logic from one agent's execution environment to another.
- Ingestion points: File system discovery of Claude-visible source roots including global rules and skills as defined in Section 1.
- Boundary markers: The workflow utilizes process gates and user confirmation but lacks content-level delimiters or 'ignore' instructions for the data being synced.
- Capability inventory: The agent is instructed to perform file reading, writing, symlink creation, and directory lock acquisition.
- Sanitization: The skill explicitly excludes credentials and telemetry in Section 1, but does not sanitize the functional logic of the synced behaviors.
- [COMMAND_EXECUTION]: The skill performs active file system mutations to configure other agents, modifying their execution environments.
- Evidence: Section 5 details procedures for replacing target paths with symlinks and writing staged adaptation bytes.
- Mitigation: All mutations are gated by a dry-run manifest, explicit user selection, and the creation of restorable backups.
Audit Metadata