agent-chief-attention-guard
Warn
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill documentation describes a feature where the agent-chief tool can execute shell commands for task verification (e.g., 'command:grep -q Analysis complete /tmp/analysis.log'). This capability allows the tool to run arbitrary commands on the local system as part of its agent management workflow.
- [INDIRECT_PROMPT_INJECTION]: The skill acts as a gateway for external events such as RSS feeds, monitoring alerts, and CI results, which are processed by an LLM to make routing decisions. This presents a vulnerability surface for indirect prompt injection where malicious content in an event could manipulate the agent's behavior.
- Ingestion points: The 'propose_event' method in the Python SDK and the HTTP API endpoint '/v1/events' in the resident daemon.
- Boundary markers: The documentation does not specify the use of delimiters or sanitization for event bodies before LLM processing.
- Capability inventory: The skill performs network operations via httpx, manages a local SQLite database (chief.db), and executes shell commands for task verification.
- Sanitization: No explicit sanitization or filtering of incoming event data is described.
- [DYNAMIC_EXECUTION]: The 'register_agent' function allows for dynamic execution of shell commands or LLM-based verification logic. This logic is triggered when the filtering engine decides to 'dispatch' a task, which is a decision influenced by potentially untrusted external inputs processed by the LLM judge.
Audit Metadata