swarm
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFECREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill instructs the agent to read configuration from
~/.claude/pstack-models.md. Accessing files within hidden directories in the user's home folder is a sensitive file access pattern that can lead to unintended data exposure if the file contains sensitive information or if the path is manipulated. - [INDIRECT_PROMPT_INJECTION]: The skill's aggregation phase (Phase C) involves reading terminal results from N parallel workers to create a consolidated report. This creates an attack surface where malicious content processed by a worker could be designed to influence the parent agent's summary or subsequent operations.
- Ingestion points: Phase C and Phase D involve reading and consolidating output from multiple
subagent_type: "general-purpose"workers. - Boundary markers: The skill does not define explicit delimiters or instructions for the agent to ignore potential instructions embedded in worker reports.
- Capability inventory: The skill has the ability to spawn background subagents, access the file system (via worktrees, branches, and
/tmp/), and perform git operations. - Sanitization: There are no instructions for sanitizing or escaping the content gathered from workers before it is aggregated into the final report.
Audit Metadata