bu-zhen
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The orchestrator and specialist subagents (Fixer, Explorer, etc.) are authorized to use shell commands for repository navigation, searching, and code modification. These capabilities are restricted by platform-level permission blocks and internal safety rules that require user confirmation for potentially dangerous operations.
- [PERSISTENCE]: The skill provides an installation mechanism via
scripts/apply_preset.py. When executed (e.g., via/布阵 install), this script copies agent definition files into the user's global application configuration directory at~/.config/opencode/agents/. This is the intended functional behavior for registering the agents with the host platform. - [INDIRECT_PROMPT_INJECTION]: The framework ingests and processes untrusted data from local codebases. To mitigate injection risks, it utilizes a mandatory 'Notepad' system for persistent state tracking across subagent sessions and enforces strict verification phases where the orchestrator must validate the results of subagent tasks before proceeding.
- [SAFE]: The skill demonstrates best-in-class security awareness by incorporating explicit rules against credential theft, symlink attacks, and remote script execution (
curl|bash). It specifically defines 'Forbidden Zones' for sensitive files like~/.sshand.env, and implements 'Doom-loop' detection to prevent resource exhaustion from repetitive tool calls.
Audit Metadata