goal-supervisor

Pass

Audited by Gen Agent Trust Hub on Aug 22, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
  • [COMMAND_EXECUTION]: Spawns the claude CLI as a background process and passes arguments that can bypass interactive safety confirmations for file edits.
  • Evidence in supervise.sh: claude -p --session-id "$SID" ${CLAUDE_EXTRA[@]+"${CLAUDE_EXTRA[@]}"} "$PROMPT" >>"$WORKER_LOG" 2>&1 &.
  • Evidence in SKILL.md: Instructions encourage using --permission-mode bypassPermissions to allow headless operation.
  • [PERSISTENCE_MECHANISMS]: Facilitates process persistence by providing instructions to configure launchd (macOS) and systemd (Linux) services.
  • Evidence in SKILL.md: Contains specific command examples and configuration templates for launchd plists and systemd user units to ensure the supervisor survives reboots.
  • [DATA_EXPOSURE_AND_EXFILTRATION]: Accesses internal application data by reading project transcripts in ~/.claude/projects/ to monitor activity heartbeats.
  • Evidence in supervise.sh: The transcript_path() function constructs specific file paths to Claude's internal JSONL session logs.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external files like goal.md and checkpoint.md to seed the worker agent's context without sanitization.
  • Ingestion points: GOAL_MD and CHECKPOINT (in supervise.sh).
  • Boundary markers: Absent.
  • Capability inventory: Spawns claude processes and writes to the filesystem.
  • Sanitization: Absent.
  • [DYNAMIC_EXECUTION]: Employs dynamic script execution for utility functions and utilizes system-level notification tools.
  • Evidence in supervise.sh: Uses python3 -c to generate UUIDs and executes osascript or notify-send for desktop alerts.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 22, 2026, 03:03 PM