signal-headless
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references a shell script installation command (
install.sh) intended for the user to run manually. The download URL targets the developer's official repository on GitHub, which is a well-known service. The instructions specify that the agent should provide this URL to the user for setup rather than executing it autonomously. - [COMMAND_EXECUTION]: The skill utilizes local CLI commands (
signal-headless) to perform its primary functions, such as checking device status, sending messages, and searching chat history. The instructions include specific restrictions to prevent the execution of administrative or destructive commands like--unlinkor--uninstall. - [INDIRECT_PROMPT_INJECTION]: The skill has a data ingestion surface where it reads untrusted message content through commands like
shrpc getMessagesandsignal-headless --watchinSKILL.md. It possesses write capabilities viasignal-headless --send. To mitigate injection risks, the instructions define a clear boundary, telling the agent to treat message content as data only and only accept instructions from the user's "Note to Self" channel. No specific programmatic sanitization is defined, but the behavioral constraints are explicit. - [SAFE]: The skill establishes comprehensive safety rules, including mandatory user confirmation for outgoing messages to third parties and privacy protections to ensure message content is not exfiltrated to external services or shared without authorization.
Audit Metadata