factory-conductor

Warn

Audited by Gen Agent Trust Hub on Nov 1, 2026

Risk Level: MEDIUMPERSISTENCECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [PERSISTENCE]: The skill establishes persistent system tasks to manage agent availability. Evidence: assets/reentry_timer.py contains logic to install and uninstall macOS LaunchAgents, systemd user timers/services, and crontab entries. These tasks periodically execute a 'watch' command to resume stalled agent sessions across restarts or logouts.\n- [COMMAND_EXECUTION]: The skill executes shell commands provided in task plans. Evidence: assets/conductor.py uses subprocess.run to execute 'verify' and 'integration' commands defined in task-plan/v1 JSON envelopes.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes structured data that contains executable instructions. Ingestion points: conductor init --plan <envelope> in assets/conductor.py reads JSON envelopes from the repository. Boundary markers: Present. Commands are stored in specific fields and validated by assets/contract_check.py against 'skill-contract C6' rules. Capability inventory: Extensive use of subprocess.run, subprocess.Popen, file system modification, and access to CLI tools like git and gh. Sanitization: Envelopes are validated for schema compliance and structural integrity before any commands are executed.\n- [DYNAMIC_EXECUTION]: Spawns detached processes and resolves interpreters dynamically. Evidence: assets/reentry.py uses subprocess.Popen with start_new_session=True to launch agent sessions detached from the conductor process. The Python interpreter path is resolved at runtime based on environment configs.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Nov 1, 2026, 10:14 AM