agents

Pass

Audited by Gen Agent Trust Hub on Oct 8, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes free-form natural language prompts to generate, improve, or sync system instructions for AI subagents.
  • Ingestion points: The skill accepts free-form input via $ARGUMENTS (SKILL.md Step 1) and reads codebase content during the 'sync' process to update agent knowledge (README.md 'Sync mode').
  • Boundary markers: There are no explicit boundary markers or 'ignore' instructions described for the interpolation of user-provided content into agent files.
  • Capability inventory: The skill utilizes Write, Edit, Bash, and Agent tools to create and modify .md files that define subagent behavior and triggers.
  • Sanitization: No explicit sanitization or validation of the input prompt is performed before it is passed to the brewcode:agent-creator specialist or written to files.
  • Mitigation: The skill implements a 'non-growth' policy for synchronization (delta <= 0 lines), which acts as a constraint against prompt bloating attacks during knowledge updates.
  • [COMMAND_EXECUTION]: The skill uses the Bash tool to perform inventory and health audits of installed agents across project, global, and plugin scopes.
  • The status mode delegates collection to a subagent that executes bash commands to check for health flags, such as verifying the presence of specific tools in agent definitions.
  • The skill uses Glob and Grep to traverse and analyze files in directories including .claude/agents/, ~/.claude/agents/, and brewcode/agents/.
  • [DATA_EXPOSURE]: The skill has the capability to read and modify files in the ~/.claude/agents/ directory.
  • While this is the intended 'Global' scope for the tool, it allows the skill to modify agent configurations that affect the user's AI environment across different projects and directories.
  • [EXTERNAL_DEPENDENCIES]: The skill relies on a shared synchronization reference file (mode-sync.md) located in a sibling directory (../skills/references/).
  • This creates a functional dependency on the presence and integrity of other local skill components within the brewcode ecosystem.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 8, 2026, 06:27 PM