crew
Warn
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: MEDIUMPERSISTENCEOBFUSCATIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONPRIVILEGE_ESCALATION
Full Analysis
- [PERSISTENCE]: The skill implements a recovery mechanism by installing a macOS LaunchAgent (dev.t3-crew.recovery) that executes a 'sweep' command every 60 seconds (scripts/t3-dispatch-setup.py).
- [PRIVILEGE_ESCALATION]: The installation process for the recovery service involves writing configuration files to ~/Library/LaunchAgents/ and using launchctl to manage user-level services.
- [OBFUSCATION]: The skill uses the 'Invisible Separator' character (U+2063) to prefix control messages (CREW_OP) passed between parent and child threads, effectively hiding these signals from standard view (scripts/t3-dispatch-state.py).
- [COMMAND_EXECUTION]: The skill relies on executing various local CLI tools, including t3, bun, python3, curl, and sqlite3, to manage the T3 environment, authentication sessions, and project state.
- [INDIRECT_PROMPT_INJECTION]: As a meta-orchestrator, the skill processes outputs from child threads that may contain instructions for the parent agent. 1. Ingestion points: Reads thread status and reports from REPORT.md and status files (scripts/t3-dispatch-state.py). 2. Boundary markers: SKILL.md instructions advise defining boundaries, and child threads are constrained by a contract template. 3. Capability inventory: Can execute system commands, manage T3 sessions, and perform file operations in project workdirs. 4. Sanitization: Implements safe_error_text to redact sensitive data like credentials and URLs from processed error logs.
Audit Metadata