autoproject

Pass

Audited by Gen Agent Trust Hub on Sep 24, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill makes extensive use of local CLI tools, including hp (herdr-projects), git, and gh (GitHub CLI), to manage threads, perform repository merges, and handle pull requests.\n- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes reports from autonomous maker and reviewer threads to make decisions, such as merging code. \n
  • Ingestion points: The coordinator reads threads/<id>.md report files and pr inbox items.\n
  • Boundary markers: The skill uses strict templates and fixed report lines (e.g., VERDICT: BETTER, HEAD:, LANDING:) defined in the protocol to delimit data.\n
  • Capability inventory: The skill can start threads, prompt agents, resolve threads, and land code changes via gh or git.\n
  • Sanitization: The instructions state that thread reports should be treated as data and not as instructions, though the logic is still influenced by the parsed status values.\n- [DYNAMIC_EXECUTION]: The coordinator dynamically generates task instructions for worker threads using shell-style heredocs and string interpolation of session-specific data (e.g., goals, candidate scope, and SHAs), which are then executed via the hp CLI tool.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 24, 2026, 02:09 PM