debate
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill dynamically assembles and executes shell commands using the
herdrtool (e.g.,herdr agent start <nome> --kind <kind> --pane <pane-id>). While the skill provides regex constraints for the agent names ([a-z][a-z0-9_-]{0,31}), the assembly of these commands from user-provided intake data represents a potential command injection surface if the parameters are not strictly sanitized by the execution environment. - [INDIRECT_PROMPT_INJECTION]: The skill acts as a mediator, ingesting and processing text files (
turnos/*.md) generated by independent sub-agents. This creates a surface for indirect prompt injection where a sub-agent could attempt to influence the mediator's behavior. - Ingestion points: The mediator reads the output of sub-agents using
herdr agent reador by directly accessing files in theturnos/directory. - Boundary markers: The skill uses strict Markdown templates (e.g.,
templates/turno.md) and a shared agenda to delimit responses. - Capability inventory: The skill possesses shell execution capabilities through the
herdrtool and file system write access for managing artifacts. - Sanitization: A mandatory 'Gate of Quality' (
qualidade.md) is used to validate each turn, checking for school adherence, citation accuracy, and formatting before the data is integrated into the synthesis. - [DYNAMIC_EXECUTION]: The skill generates and manages external agent processes at runtime based on the intake configuration. It orchestrates a multi-pane layout and issues commands to sub-agents, relying on dynamic logic to control the debate flow and handle retries.
Audit Metadata