agents-bridge
Pass
Audited by Gen Agent Trust Hub on Nov 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONMETADATA_POISONING
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates data and message exchange between different AI agents through shared files and a structured messaging system, establishing a surface for indirect prompt injection.
- Ingestion points: The
scripts/bridge.pyscript reads and processes 'truth sources', 'memory silos', and JSON-based 'messenger event files' from the local file system. - Boundary markers: The skill uses HTML comment delimiters (e.g.,
<!-- source-begin -->and<!-- source-end -->) when generating file projections to help agents distinguish between generated content and original sources. - Capability inventory: The skill possesses the capability to perform local file reads, writes, and directory management within a root directory enforced by path validation.
- Sanitization: The skill implements a sophisticated privacy-gating system in
scripts/bridge.pythat uses regular expressions to detect and either reject or redact private keys, API credentials (GitHub, OpenAI), and personal absolute file paths (User home directories). - [METADATA_POISONING]: The skill's metadata in the
SKILL.mdfrontmatter identifies the author as 'Lukas Geiger + Codex', which is inconsistent with the provided vendor context of 'ellmos-ai'.
Audit Metadata