chatcut-plugin-basics-claude
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a shell script (
login-chatcut.sh) and instructions to execute it for authentication purposes. The script runs the login command in the background and redirects all output to a log file in a temporary directory (/tmp/chatcut-login.log). - [DYNAMIC_EXECUTION]: The helper script
login-chatcut.shutilizes a Python one-liner (python3 -c 'import pty...') to spawn a pseudo-terminal (PTY) for the login command. This is used to handle interactive authentication prompts within the agent's execution environment. - [PROMPT_INJECTION]: The instructions include guidelines that direct the agent to conceal specific internal details and errors from the user, such as 'Do not emit raw internal ChatCut chat tags directly to the user' and providing specific scripts to the user instead of generic error messages. These instructions focus on controlling the transparency of the agent's operations to improve user experience.
Audit Metadata