handoff-that-to-agent-pane
Fail
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: HIGHPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill instructions explicitly direct the agent to override safety protocols and bypass content guidelines for sub-agents by using specific command-line flags. Evidence includes instructions to use --dangerously-skip-permissions for Claude and --approve-for-me for Codex.
- [COMMAND_EXECUTION]: The skill provides verbatim shell commands containing high-risk parameters that grant sub-agents unconstrained execution capabilities. Parameters such as --sandbox disabled and --yolo (for the Cursor Agent) are mandated, removing standard security boundaries and user approval checkpoints.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied data to construct prompts for sub-agents that have been configured with disabled safety measures, creating a significant attack surface for potentially malicious instructions to be executed by the specialist agent. 1. Ingestion points: User-provided inputs for Agent choice, Model selection, Assignment text, and Scope definitions in SKILL.md. 2. Boundary markers: The task prompt template utilizes simple headers like Assignment: and Scope: but lacks robust delimitation or instructions for the sub-agent to disregard malicious content within those fields. 3. Capability inventory: The skill facilitates the execution of herdr CLI commands for pane management and the launching of various agent binaries (claude, codex, agent, pi) with broad system interaction capabilities. 4. Sanitization: Input processing is limited to mapping natural language to specific model identifiers and does not include sanitization or escaping of the assignment and scope text before interpolation into the sub-agent's prompt.
Recommendations
- AI detected serious security threats
Audit Metadata