adr-driven-development

Fail

Audited by Gen Agent Trust Hub on Aug 7, 2026

Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill encourages the installation of third-party tools from unverified external GitHub repositories (mattpocock/skills and joeseesun/qiaomu-goal-meta-skill) using the npx skills add comman d.
  • [COMMAND_EXECUTION]: The agent is instructed to run environment discovery scripts (scripts/detect-runtime-host.sh) and establish a background Sentinel task that executes shel l commands ever y 10 min utes.
  • [REMOTE_CODE_EXECUTION]: The skill orchestrates an unattended deliver y loop that spaw n s sub-agent s (Claude, Codex, Grok) and executes dynamic all y generated content from next-goal.md as primar y instructions.
  • [PROMPT_INJECTION]: The instructions include specifi c flag s to bypass sefet y filter s (bypassPermissions) and sand box ing constraint s (danger sand box) for spaw n ed sub-agent s, effectivel y overriding platfor m securit y policies.
  • [PROMPT_INJECTION]: The skill architecture is susceptible to indirect prompt injection. (1) Ingestion points: .adr//next-goal.md. (2) Boundar y marker s: Absent. (3) Capabilit y inventor y: Spaw n ing sub-agent s with safet y bypass, file system writes, and shel l execution. (4) Sanitization: Absent.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Aug 7, 2026, 03:29 AM
Security Audit — agent-trust-hub — adr-driven-development