act-post-decision
Pass
Audited by Gen Agent Trust Hub on Aug 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local scripts using bash and node (ensure-deps.sh and db.mjs). These are shared helpers located in the platform's root directory (CLAUDE_PLUGIN_ROOT) used for dependency management and database interaction.
- [PROMPT_INJECTION]: The skill identifies a surface for indirect prompt injection as it processes text from external decisions. It includes explicit instructions to treat this content as data rather than executable instructions for the agent itself.
- Ingestion points: Neon task list (list-blocked) and Jupi decision details (get-decision) in SKILL.md.
- Boundary markers: Includes an explicit instruction to ignore embedded commands within signal or option text.
- Capability inventory: Can trigger tool writes via execute-action, update task statuses in Neon, mark actions as done in Jupi, and append to a rules store across ALL scripts.
- Sanitization: No explicit sanitization logic is defined in the instructions; it relies on the boundary instruction.
Audit Metadata