pstack-harness
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONPERSISTENCE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill acts as an adapter for interpreting and executing other "pstack skills" located in sibling directories. This established process creates a vulnerability surface where instructions within those external files could influence the agent's logic.
- Ingestion points: Sibling
SKILL.mdfiles. - Capability inventory: The skill directs the agent to spawn subprocesses and access file system data (transcripts and configurations).
- Boundary markers: Explicit instructions to read and follow sibling skill files directly.
- Sanitization: No sanitization or validation of the ingested skill content is described.
- [COMMAND_EXECUTION]: The instructions direct the agent to utilize shell subprocesses (e.g.,
codex exec,hermes -z, or the agent's own CLI) as a fallback mechanism for task delegation when native tools are unavailable. - [PERSISTENCE]: The skill mentions the use of
cronas a potential wrapper for managing scheduled loops or task wake-ups.
Audit Metadata