dispatch
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONPERSISTENCE
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions in
SKILL.mddirect the agent to execute a local shell script (scripts/setup-agents.sh) to initialize or update subagent tiers. This is a standard administrative task for configuring the local development environment. - [DYNAMIC_EXECUTION]: The
setup-agents.shscript dynamically generates instruction files for subagents (~/.claude/agents/*.md) and uses an inline Python snippet to modify the tool's JSON configuration (~/.claude/settings.json). The code generated is based on hardcoded templates within the script. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data from an external hook (classification labels) and user-supplied requests to form a "briefing" for subagents.
- Ingestion points:
SKILL.mdreadsRoute:metadata from the system context and takes the user's request verbatim. - Boundary markers: The skill composes a structured briefing but does not explicitly use delimiters or "ignore" instructions for the subagent.
- Capability inventory: The skill uses the
Agentdelegation tool to spawn subagents and shell execution viasetup-agents.shfor filesystem writes. - Sanitization: No explicit sanitization or filtering of the user's input or hook metadata is described before it is passed to subagents.
- [PERSISTENCE]: The skill modifies the user's local configuration directory (
~/.claude/) to store agent definitions and permission settings (e.g., denyinggeneral-purpose) that remain in effect across different sessions.
Audit Metadata