farm-out
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses Bash scripts (
farm.sh,farm-team.sh) to execute local CLI wrappers such asclaude-code,codex-code, andgemini-code. These tools are used to run agent tasks in separate processes with their own execution context.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from task files (JSON format) and interpolates this data into prompts for delegated agents.\n - Ingestion points: The
scripts/farm.shscript reads task definitions, including prompts and labels, from a file specified via the--tasksargument.\n - Boundary markers: The script automatically appends an anti-simulation clause to instructions to discourage the delegated model from fabricating completion reports.\n
- Capability inventory: Delegated processes are full agent sessions capable of tool use, filesystem modifications, and network interaction via a local proxy.\n
- Sanitization: Content from the task files is processed using
jqfor structure, but the natural language prompts are not sanitized before interpolation.
Audit Metadata