agent-manager-skill
Warn
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user or agent to clone a repository from a GitHub account that is not recognized as a trusted vendor (fractalmind-ai/agent-manager-skill). While the skill includes historical context and warnings, the primary mechanism relies on downloading external content.- [COMMAND_EXECUTION]: The documentation provides specific command patterns for executing Python scripts (python3 agent-manager/scripts/main.py) from the downloaded external repository, facilitating the execution of unverified code in the local environment.- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest task descriptions from external files (e.g., teams/fractalmind-ai-maintenance.md) and pipe them into the agent manager via the 'assign' command. This creates a surface where malicious instructions embedded in project documentation could influence agent behavior.
- Ingestion points: Input files and here-documents used with the 'assign' command in SKILL.md.
- Boundary markers: Absent; the examples show direct piping of content without delimiters or ignore-instruction warnings.
- Capability inventory: The skill manages local subprocesses via tmux (start/stop/monitor/assign).
- Sanitization: Absent; there is no mention of validation or filtering for the ingested task content.
Audit Metadata