chain-builder
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill documentation provides examples of shell commands (using cat, grep, and cut) to inspect active chain configurations. It also describes a comprehensive hook system that executes custom scripts from the .claude/hooks/ directory at various lifecycle events (e.g., PreToolUse, SessionStart, Stop).
- [PROMPT_INJECTION]: The skill facilitates multi-agent orchestration by automatically passing the output of a completed agent as context to the next agent in the sequence. This creates a surface for indirect prompt injection.
- Ingestion points: Workflow results are stored in ~/.claude/tmp/agent-outputs/ and injected into the subsequent agent's input by the runner script.
- Boundary markers: Injected content is delimited by a '## Previous Agent Output ({type})' header.
- Capability inventory: The skill utilizes MCP tools for chain management, shell command execution, and a custom hook system for script execution.
- Sanitization: No explicit sanitization or filtering of the previous agent's output is mentioned before its interpolation into the next prompt.
- [DATA_EXFILTRATION]: The skill manages project-specific configuration files and temporary state files within the .claude/ and ~/.claude/ directories. No patterns of sensitive data harvesting or unauthorized network transmission were identified.
Audit Metadata