fleet-copilot
Pass
Audited by Gen Agent Trust Hub on Nov 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes a shell command to execute a local Python script (
.claude/tools/amplihack/lock_tool.py) to enable a "lock mode." This script appears to be a part of the local toolset associated with the skill author. - [INDIRECT_PROMPT_INJECTION]: The skill takes untrusted natural language input from the user to formulate autonomous goals and a "Definition of Done," which are then written to a lock file used for agent reasoning.
- Ingestion points: User natural language input provided at skill activation (SKILL.md).
- Boundary markers: The skill does not define specific delimiters or "ignore instructions" warnings when interpolating user-derived goals into the
.lock_goalfile. - Capability inventory: The skill possesses the ability to execute local scripts and perform autonomous tasks until a goal is met, reducing human oversight.
- Sanitization: There is no evidence of sanitization or validation of the user-provided content before it is used to define the agent's autonomous behavior.
Audit Metadata