agentic-jujutsu
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The JjWrapper class provides a jj.execute() method for running shell commands. Documentation examples show the skill performing operations like jj.execute(['git', 'push', 'origin', 'main']), indicating a general capability to execute subprocesses on the host system.
- [INDIRECT_PROMPT_INJECTION]: The ReasoningBank feature establish a vulnerability surface by ingesting task descriptions and critiques to generate future suggestions and recommended operations. Malicious instructions embedded in past trajectories could potentially manipulate the agent's logic in subsequent sessions.
- Ingestion points: Data enters the system via jj.startTrajectory, jj.finalizeTrajectory, and jj.getSuggestion within SKILL.md.
- Boundary markers: The documentation does not specify the use of delimiters or instructions to ignore embedded commands within the ReasoningBank suggestions.
- Capability inventory: The skill uses its command execution wrapper (jj.execute) to fulfill AI-generated recommendations.
- Sanitization: There is no evidence in the provided examples of sanitization or validation of the recommendedOperations before they are executed.
- [EXTERNAL_DOWNLOADS]: The skill recommends installation via npx agentic-jujutsu and provides links to external resources on GitHub (github.com/ruvnet/agentic-flow) for documentation and source code.
- [DYNAMIC_EXECUTION]: The Self-Improving Agent implementation illustrates a pattern where the agent dynamically iterates through and executes a list of commands (suggestion.recommendedOperations) generated by the self-learning engine at runtime.
Audit Metadata