delegate-task
Warn
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The
execute_tasktool enables the execution of arbitrary natural language instructions through an autonomous worker with capabilities for coding and DevOps tasks. - [EXTERNAL_DOWNLOADS]: The
search_skillstool includes anauto_importparameter that, by default, fetches and stores code from a remote cloud community to the local system. - [DATA_EXFILTRATION]: The
upload_skilltool facilitates sending local directory contents to a remote cloud community, with a default visibility of 'public', which may lead to unintended data exposure if misused. - [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection due to its autonomous task processing and skill evolution mechanisms.
- Ingestion points: The tool parameters
taskandqueryaccept untrusted natural language input. - Boundary markers: No delimiters or protective instructions are present to mitigate the execution of malicious commands embedded in task descriptions.
- Capability inventory: The delegated agent has extensive permissions for file system access, network communication, and command execution.
- Sanitization: No input validation is performed before processing tasks or capturing workflows into reusable skills.
Audit Metadata