cc-p4p-router
Pass
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The instructions utilize aggressive directives to override standard agent behavior and autonomy, such as "THE ONLY ENTRY POINT... never skip", "CRITICAL: Execute workflow immediately", and "NEVER list capabilities. ALWAYS execute."- [COMMAND_EXECUTION]: The skill invokes the Bash tool to execute shell commands (
mkdir -p .claude/cc-p4p) for directory creation. While currently limited to directory setup, it represents a direct shell execution capability.- [PROMPT_INJECTION]: Indirect Prompt Injection Surface: The skill interpolates untrusted user-provided requests directly into prompts for sub-agents (e.g., in the SPEC and RESEARCH workflows) without sanitization or clear boundary instructions. - Ingestion points:
SKILL.md(Workflow Execution and Agent Invocation Template sections). - Boundary markers: Missing (uses standard headers but lacks explicit "ignore instructions" delimiters for the
{request}variable). - Capability inventory:
Bash,Read,Write,Edit,TaskCreate, andTask(sub-agent invocation). - Sanitization: None detected; user input is passed directly to the next agent in the chain.
Audit Metadata