dual-brain-plan
Fail
Audited by Gen Agent Trust Hub on Mar 29, 2026
Risk Level: HIGHCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands (test and build) derived directly from project files like
package.json,AGENTS.md, andCLAUDE.md. If an attacker can influence these files (e.g., in a malicious repository or pull request), they can achieve arbitrary code execution on the user's system. - [REMOTE_CODE_EXECUTION]: The implementation notes in
executor-routing.mdexplicitly recommend using the--dangerously-bypass-approvals-and-sandboxflag for Codex sessions to achieve full autonomy. This removes critical security guardrails and allows the agent to perform potentially destructive actions without user oversight. - [PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection. It ingests untrusted data from brainstorms and plans, then inlines this content directly into prompts for secondary agent sessions (
sessions_spawn). - Ingestion points: Data enters through user-provided brainstorms and the contents of files in
docs/plans/. - Boundary markers: The skill uses basic markdown headers (e.g.,
## Plan to Review) but lacks robust delimiters or explicit instructions to the sub-agents to ignore embedded commands within the processed text. - Capability inventory: The spawned agents have significant capabilities, including file system access and shell execution via the OpenClaw
sessions_spawntool. - Sanitization: No sanitization or escaping of the inlined content is performed before passing it to the next stage of the pipeline.
Recommendations
- AI detected serious security threats
Audit Metadata