autoproject
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill makes extensive use of local CLI tools, including
hp(herdr-projects),git, andgh(GitHub CLI), to manage threads, perform repository merges, and handle pull requests.\n- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes reports from autonomous maker and reviewer threads to make decisions, such as merging code. \n - Ingestion points: The coordinator reads
threads/<id>.mdreport files andprinbox items.\n - Boundary markers: The skill uses strict templates and fixed report lines (e.g.,
VERDICT: BETTER,HEAD:,LANDING:) defined in the protocol to delimit data.\n - Capability inventory: The skill can start threads, prompt agents, resolve threads, and land code changes via
ghorgit.\n - Sanitization: The instructions state that thread reports should be treated as data and not as instructions, though the logic is still influenced by the parsed status values.\n- [DYNAMIC_EXECUTION]: The coordinator dynamically generates task instructions for worker threads using shell-style heredocs and string interpolation of session-specific data (e.g., goals, candidate scope, and SHAs), which are then executed via the
hpCLI tool.
Audit Metadata