ops-daemon

Warn

Audited by Gen Agent Trust Hub on Oct 8, 2026

Risk Level: MEDIUMPERSISTENCECOMMAND_EXECUTIONPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [PERSISTENCE]: The skill's primary function is to manage a background service via a launchd plist file located at ~/Library/LaunchAgents/com.claude-ops.daemon.plist.
  • [COMMAND_EXECUTION]: The skill executes multiple shell scripts, including ops-daemon-manager.sh and ops-daemon.sh, with support for command-line arguments that control system state.
  • [PRIVILEGE_ESCALATION]: The skill performs service management tasks including loading/unloading launchd agents, killing processes by PID, and modifying service configurations in daemon-services.json.
  • [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect injection by processing untrusted data to drive logic.
  • Ingestion points: Reads and parses daemon-health.json and daemon-services.json to determine daemon state and service commands.
  • Boundary markers: None identified; the agent is instructed to trust the JSON snapshot for diagnostics.
  • Capability inventory: The skill uses the Bash tool to execute scripts, the Write tool to modify configuration files, and can terminate processes via kill commands based on data in the health file.
  • Sanitization: The skill assumes the integrity of the health and service configuration files, which could lead to unauthorized command execution if these files are compromised.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Oct 8, 2026, 09:51 PM