agent-manager-skill
Fail
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs cloning a repository from an unknown GitHub organization (
fractalmind-ai). - [REMOTE_CODE_EXECUTION]: Instructions follow the download with commands to execute the downloaded Python scripts (
python3 agent-manager/scripts/main.py), allowing arbitrary code from a remote source to run locally. - [PERSISTENCE]: The skill facilitates long-term persistence by providing features to schedule recurring agent tasks using the
cronutility. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input in the form of task assignments for parallel agents, creating a surface for indirect prompt injection.
- Ingestion points: The
assigncommand accepts multi-line task instructions. - Boundary markers: Examples use shell heredoc delimiters (
<<'EOF'). - Capability inventory: The skill manages tmux sessions and executes CLI agents via subprocesses.
- Sanitization: No input validation or sanitization is performed on ingested tasks.
Recommendations
- AI detected serious security threats
Audit Metadata