agent-to-agent
Pass
Audited by Gen Agent Trust Hub on Nov 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary purpose is to establish a communication bridge between separate AI agent sessions, creating a significant attack surface for cross-agent instruction injection.
- Ingestion points: External messages received from a remote agent via the foragent.io relay (documented in SKILL.md).
- Boundary markers: Absent; the skill provides no instructions for agents to delimit incoming messages or treat them as untrusted content.
- Capability inventory: The agents targeted for connection (e.g., Claude Code, Codex, VS Code) possess powerful capabilities including file system access and shell command execution.
- Sanitization: Absent; no mention of sanitizing or validating the content exchanged between agents.
- [EXTERNAL_DOWNLOADS]: The skill directs the user to download and install a third-party application from an unverified external domain (foragent.io) to enable native agent integration.
- [DATA_EXFILTRATION]: By facilitating the exchange of data between agents through an external third-party relay service, the skill inherently risks exposing sensitive code or project metadata to the service provider.
Audit Metadata