t3-dispatch
Pass
Audited by Gen Agent Trust Hub on Nov 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data (issue titles, bodies, and consensus) from the Fast Ship API to prioritize and assign tasks.
- Ingestion points: External data is fetched in
scripts/sources/fast-ship.mjsand passed to the agent's context. - Boundary markers: The skill contains clear instructions in
SKILL.mdandscripts/sources/fast-ship.mjsto treat issue content as data rather than instructions. - Capability inventory: The skill has capabilities to launch threads via
t3_thread_launch, execute local scripts usingspawnSync, and write to local state files. - Sanitization: External content is clipped to a summary but no rigorous sanitization of malicious prompt patterns is performed.
- [COMMAND_EXECUTION]: The skill utilizes
child_process.spawnSyncto execute Node.js scripts for API interactions and local state management. - [EXTERNAL_DOWNLOADS]: The skill recommends the installation of a related skill from the author's GitHub repository (
github.com/gitbobobo/fast_ship).
Audit Metadata