spawn
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes an internal Python script
session_manager.pyto update the session state. This script is part of the skill's own package and is used for management purposes. - [INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection because it ingests untrusted data from session configuration files and task descriptions to build prompts for subagents. The subagents have capabilities to modify files and execute tests within their worktrees.
- Ingestion points: Reads data from
.agenthub/sessions/{session-id}/config.yaml,references/agent-templates.md, and the user-provided session task inSKILL.md. - Boundary markers: The instructions do not define clear delimiters or "ignore" instructions for the interpolated
{task}and{variables}fields in the subagent prompt templates. - Capability inventory: The spawned subagents can modify the filesystem, run tests, and commit changes to git worktrees. The main skill executes the
session_manager.pyscript. - Sanitization: There is no evidence of sanitization or validation of the task content or session variables before they are injected into subagent prompts.
Audit Metadata