system-fixer

Warn

Audited by Gen Agent Trust Hub on May 18, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: Executes multiple complex SQL queries against production database tables, including agent_findings, ig_operations_config, and Subscription, to perform health checks and detect data drift.
  • [COMMAND_EXECUTION]: Defines a persistence mechanism via a nightly cron schedule (02:00 CT) triggered by a shell script (docs/bridge/sync.sh --fixer) to maintain automated execution across sessions.
  • [DATA_EXFILTRATION]: Accesses and processes highly sensitive business information, including customer billing records in the Subscription table and the docs/FACT_LEDGER.md file, as well as internal system security configurations.
  • [PROMPT_INJECTION]: Exhibits an indirect prompt injection surface in 'Block I', where the skill parses unstructured text from handoff documents and ledger files to extract claims. Ingestion points: Untrusted data is ingested from docs/SESSION_HANDOFF_*.md, docs/FACT_LEDGER.md, and docs/SYSTEM_REGISTRY.md. Boundary markers: The skill lacks explicit boundary markers or instructions to ignore embedded instructions within the processed data. Capability inventory: The skill has the capability to execute SQL commands and write findings to the local filesystem (docs/bridge/FIXER_REPORT.md). Sanitization: No validation or sanitization of the extracted text is performed before it is used to influence the audit report.
Audit Metadata
Risk Level
MEDIUM
Analyzed
May 18, 2026, 05:38 AM