peer-message

Pass

Audited by Gen Agent Trust Hub on Aug 31, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/peer.py executes the codex command-line utility via subprocess.run to interface with the Codex message queue.
  • [INDIRECT_PROMPT_INJECTION]: The skill facilitates communication between agents, creating a surface for indirect prompt injection where one agent's output influences another's context. * Ingestion points: Message content is ingested through CLI arguments or file reads in scripts/peer.py. * Boundary markers: The protocol uses specific XML-style delimiters (<cross-session-message> and <peer-message>) and advisory text to help receiving agents distinguish peer input from direct user commands. * Capability inventory: The skill possesses file read access for transcripts and databases, Unix Domain Socket write access, and shell command execution. * Sanitization: The script performs XML attribute escaping and validates that message bodies do not contain reserved tags that could escape the delivery envelope.
  • [DATA_EXFILTRATION]: To perform its fallback messaging and verification, the skill accesses sensitive local files, including Claude session authentication tokens (peerToken) from ~/.claude/sessions/*.key and internal Codex SQLite databases (state, queue, thread_history).
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 31, 2026, 03:06 AM
Security Audit — agent-trust-hub — peer-message