starworkMultiagent
Pass
Audited by Gen Agent Trust Hub on Nov 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon data from external sources within the project workspace, creating a potential surface for indirect instruction overrides.\n
- Ingestion points: The skill reads several project files including
AGENTS.md,_system/collaboration/shared.md, and session transcripts retrieved via theread_threadormcp__ccd_session_mgmt__search_session_transcriptstools.\n - Boundary markers: The skill uses explicit delimiters (
<!-- STARWORK:MULTIAGENT_MESSAGE v1 -->) in its message templates to wrap instructions, which provides a structural boundary between system instructions and data content.\n - Capability inventory: The skill can execute various
starworkCLI commands for state management and utilize platform tools to create threads, send messages, and modify thread properties (pinned, archived, title).\n - Sanitization: There is no evidence of sanitization or escaping logic being applied to the data interpolated into the instruction templates defined in
references/message-templates.md.\n- [COMMAND_EXECUTION]: The skill orchestrates project tasks by executing a specific local CLI tool.\n - Evidence: The skill frequently references executing
starworkCLI commands such asdoctor,multiagent status,multiagent init,multiagent bind, andmultiagent upgrade.\n - Safety Controls: The instructions mandate that all state-changing commands must be preceded by a
--dry-runfor user preview or require an explicit--yesflag following user confirmation to prevent accidental or unauthorized modifications.
Audit Metadata