agent-composer

Pass

Audited by Gen Agent Trust Hub on Oct 4, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: Executes shell commands via the Bash tool and uses the fh-run CLI to manage agent dispatches.
  • [EXTERNAL_DOWNLOADS]: Fetches and executes the @chrono-meta/fh-gate package from the npm registry using the npx utility (SKILL.md).
  • [DYNAMIC_EXECUTION]: Dynamically assembles agent briefs, context cards, and execution plans at runtime, which are then processed via the Agent tool or the fh-run command.
  • [INDIRECT_PROMPT_INJECTION]:
  • Ingestion points: Reads capability definitions and project context from files such as .claude/agents/*.md, LOCAL_SKILL_REGISTRY.md, .mcp.json, and CLAUDE.md (SKILL.md, SKILL_detail.md).
  • Boundary markers: Utilizes Session Context Cards and a token-limited Agent Registry to provide context to isolated sub-agents.
  • Capability inventory: The skill has access to file system reading (Read, Glob, Grep), shell execution (Bash), and agent/skill invocation (Agent, Skill).
  • Sanitization: No specific sanitization or validation logic is defined for the content extracted from local registry or configuration files.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 4, 2026, 08:09 PM