dispatch

Warn

Audited by Gen Agent Trust Hub on Jul 3, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill is designed to invoke external command-line interfaces (codex and agy) directly from the agent environment. It interprets user intent to construct and run shell commands, such as codex review --uncommitted.
  • [DATA_EXFILTRATION]: Local project data, including uncommitted code changes and architectural context, is transmitted to external AI services via the integrated CLI tools. While these tools use native authentication, the content is sent outside the local environment.
  • [EXTERNAL_DOWNLOADS]: The skill requires and encourages the installation of specific third-party CLI tools (codex, agy) and references a non-standard public repository (sparklingneuronics/sparkling-skills) for its plugin components. These tools are not standard system or official vendor utilities.
  • [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from external tool outputs.
  • Ingestion points: Output generated by the codex and agy command-line tools is fed directly into the agent's context for summarization and critique.
  • Boundary markers: There are no explicit delimiters or boundary instructions provided to help the agent distinguish between the external tool's data and the system's own instructions.
  • Capability inventory: The skill utilizes shell command execution and possesses the ability to read local file system contents (e.g., project changes).
  • Sanitization: No sanitization or validation logic is defined to filter or escape the content returned by external tools before it is processed by the agent.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Jul 3, 2026, 02:43 PM
Security Audit — agent-trust-hub — dispatch