herd-flow
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill is designed to manage external processes through the
herdrandpiCLI tools. It provides Claude with instructions to construct and execute shell commands for terminal pane manipulation (splitting, renaming, running tasks) and monitoring worker states. - [INDIRECT_PROMPT_INJECTION]: The protocol creates a vulnerability surface by having the lead agent ingest and act upon report files generated by delegated sub-agents (
pi). This multi-agent chain is susceptible to instructions embedded in sub-agent output that could influence the orchestrator's decisions. - Ingestion points:
SKILL.md(Step 4) specifies that the orchestrator must harvest and review report files generated by thepiworker. - Boundary markers: The skill does not define specific delimiters or instructions to ignore embedded prompts within the harvested reports.
- Capability inventory: The skill possesses the ability to execute shell commands, manage terminal panes, and write/edit files via the delegated tools.
- Sanitization: While the skill advises a "sanity-check" of the reports, it lacks concrete implementation details for sanitization or automated validation of external content.
Audit Metadata