agy-delegation-workflow
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes the agy (Antigravity) CLI tool and a helper shell script (dispatch-agy.sh) to launch background execution tasks. The commands include flags like --dangerously-skip-permissions which bypass standard user confirmation prompts for file modifications and other tool actions.
- [INDIRECT_PROMPT_INJECTION]: The skill creates a surface for indirect prompt injection by instructing the agent to read and process instructions from local markdown files.
- Ingestion points: The workflow involves reading task definitions from .agy-tasks/*.md files and piping their content directly into the execution tool.
- Boundary markers: There are no formal delimiters or systemic protections used to isolate the task content from the execution engine's core instructions.
- Capability inventory: The agy tool has significant capabilities including creating/modifying code files, performing refactors, and executing arbitrary test commands in the shell.
- Sanitization: The skill relies on post-execution review and auditing (using grep commands and a dual-round-review process) rather than pre-execution sanitization of the input task files.
Audit Metadata