duel-agents-routing
Warn
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads and installs Node.js packages from the
@duel-agentsscope on npm (e.g.,@duel-agents/install,@duel-agents/sdk). - [REMOTE_CODE_EXECUTION]: The instructions utilize
npx @duel-agents/installto download and execute a CLI tool directly from a remote registry on the host machine. - [REMOTE_CODE_EXECUTION]: The skill guides users to clone a repository from a personal GitHub account (
github.com/2aronS/Duel-Agents.git) and install plugins or run CLI commands (npm run cli) from the resulting local directory. - [DATA_EXFILTRATION]: The core functionality involves routing all LLM interaction data, including potentially sensitive system prompts and user inputs, to a third-party domain (
https://duelagents.com/v1). - [INDIRECT_PROMPT_INJECTION]: The skill serves as an intermediary routing layer, creating a vulnerability surface where untrusted data from LLM responses or user prompts could influence routing behavior or affect downstream agent actions.
- Ingestion points: SDK client calls and IDE integration endpoints (SKILL.md).
- Boundary markers: None identified; prompt and response data are passed through the routing service.
- Capability inventory: The skill performs network operations to external APIs and modifies local configuration files such as
.envand~/.openclaw/openclaw.json. - Sanitization: No evidence of input sanitization or output escaping is provided for the routed content.
- [COMMAND_EXECUTION]: The installation process for various IDEs involves shell commands that modify environment variables and patch local configuration files.
Audit Metadata