pair
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill uses a coordination protocol that instructs the lead agent to execute shell commands derived from the partner agent's output (e.g., in
[herdr-pair control ...]lines). A malicious partner could attempt to inject commands into these protocol lines.\n - Ingestion points: Partner agent output and Herdr panes read via
herdr agent readinscripts/herdr-pair.mjsandscripts/pair-headless.mjs.\n - Boundary markers: The protocol uses specific headers but relies on the lead agent to interpret the instruction string.\n
- Capability inventory: The skill spawns subprocesses for various agent CLIs and performs repository file operations across
scripts/herdr-pair.mjsandscripts/pair-headless.mjs.\n - Sanitization: No automatic validation is performed on the command string before the lead agent is prompted to execute it.\n- [COMMAND_EXECUTION]: The skill automates execution of well-known agent tools (
claude,codex,cursor-agent,grok,opencode) usingexecFileSyncandspawn. It explicitly sets high-privilege flags (e.g.,bypassPermissions,danger-full-access,--force) to enable autonomous implementer roles.
Audit Metadata