goal-supervisor
Pass
Audited by Gen Agent Trust Hub on Aug 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: Spawns the
claudeCLI as a background process and passes arguments that can bypass interactive safety confirmations for file edits. - Evidence in
supervise.sh:claude -p --session-id "$SID" ${CLAUDE_EXTRA[@]+"${CLAUDE_EXTRA[@]}"} "$PROMPT" >>"$WORKER_LOG" 2>&1 &. - Evidence in
SKILL.md: Instructions encourage using--permission-mode bypassPermissionsto allow headless operation. - [PERSISTENCE_MECHANISMS]: Facilitates process persistence by providing instructions to configure
launchd(macOS) andsystemd(Linux) services. - Evidence in
SKILL.md: Contains specific command examples and configuration templates forlaunchdplists andsystemduser units to ensure the supervisor survives reboots. - [DATA_EXPOSURE_AND_EXFILTRATION]: Accesses internal application data by reading project transcripts in
~/.claude/projects/to monitor activity heartbeats. - Evidence in
supervise.sh: Thetranscript_path()function constructs specific file paths to Claude's internal JSONL session logs. - [INDIRECT_PROMPT_INJECTION]: The skill processes external files like
goal.mdandcheckpoint.mdto seed the worker agent's context without sanitization. - Ingestion points:
GOAL_MDandCHECKPOINT(insupervise.sh). - Boundary markers: Absent.
- Capability inventory: Spawns
claudeprocesses and writes to the filesystem. - Sanitization: Absent.
- [DYNAMIC_EXECUTION]: Employs dynamic script execution for utility functions and utilizes system-level notification tools.
- Evidence in
supervise.sh: Usespython3 -cto generate UUIDs and executesosascriptornotify-sendfor desktop alerts.
Audit Metadata