add-signal
Pass
Audited by Gen Agent Trust Hub on Apr 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Uses
sudowith system package managers (apt-get,dnf) to install Java 17, which is a required dependency for the Signal CLI. - [COMMAND_EXECUTION]: Manages the application daemon using platform-specific service managers (
launchctlon macOS andsystemctlon Linux) to ensure the Signal integration runs as a background process. - [EXTERNAL_DOWNLOADS]: Fetches the
signal-clibinary and associated version metadata from GitHub's official API and releases pages. - [REMOTE_CODE_EXECUTION]: Executes a Python snippet via the command line to parse version information from a GitHub API response. While this involves piping data to an interpreter, it is a localized operation for configuration purposes rather than the execution of remote scripts.
- [PROMPT_INJECTION]: The skill establishes a communication channel that ingests data from Signal messages, creating a surface for indirect prompt injection.
- Ingestion points: Incoming messages from Signal users are received via the
signal-clidaemon and processed by the system (referenced insrc/channels/signal.ts). - Boundary markers: The setup instructions do not detail the use of specific delimiters or markers to separate external user input from system instructions.
- Capability inventory: The environment allows for file system writes to project source directories, shell command execution via binary management, and local database modifications via
sqlite3. - Sanitization: No specific input sanitization or validation steps for incoming messaging data are described in the provided configuration files.
Audit Metadata