paseo-relay
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to fetch and process agent logs, timelines, and command outputs from remote Paseo daemons (e.g., via
paseo logs,paseo inspect, andscripts/read.mjs timeline). These data sources are controlled by the remote host and could contain malicious instructions intended to influence the agent's subsequent analysis or reporting. - Ingestion points: Remote logs and timeline entries are ingested through the Paseo CLI and the
scripts/read.mjsSDK helper. - Boundary markers:
SKILL.mdinstructs the agent to label evidence and separate historical snapshots from live updates, but does not specify strict delimiters to isolate untrusted remote content. - Capability inventory: The skill possesses significant capabilities, including executing remote commands (
paseo run,paseo send), writing local files (writePrivateFile), and performing network operations via the Paseo Relay WebSocket protocol. - Sanitization: The
scripts/read.mjsscript purposefully withholds upstream exception details to prevent leaking sensitive session data, but the content of the conversation entries themselves is not sanitized for potential injection patterns.
Audit Metadata