peer-message
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/peer.pyexecutes thecodexcommand-line utility viasubprocess.runto interface with the Codex message queue. - [INDIRECT_PROMPT_INJECTION]: The skill facilitates communication between agents, creating a surface for indirect prompt injection where one agent's output influences another's context. * Ingestion points: Message content is ingested through CLI arguments or file reads in
scripts/peer.py. * Boundary markers: The protocol uses specific XML-style delimiters (<cross-session-message>and<peer-message>) and advisory text to help receiving agents distinguish peer input from direct user commands. * Capability inventory: The skill possesses file read access for transcripts and databases, Unix Domain Socket write access, and shell command execution. * Sanitization: The script performs XML attribute escaping and validates that message bodies do not contain reserved tags that could escape the delivery envelope. - [DATA_EXFILTRATION]: To perform its fallback messaging and verification, the skill accesses sensitive local files, including Claude session authentication tokens (
peerToken) from~/.claude/sessions/*.keyand internal Codex SQLite databases (state,queue,thread_history).
Audit Metadata