aider-delegate
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of a task 'brief' and existing project files which are subsequently processed by the Aider sub-agent, creating a vector for potential instruction injection.\n
- Ingestion points: The
brief.txtfile (user-provided instructions) and repository files targeted for editing or provided as context.\n - Boundary markers: The documentation explicitly acknowledges that context-management flags are not security boundaries and warns the user that the implementer is not sandboxed.\n
- Capability inventory: The delegated tool (
aider) possesses the ability to perform filesystem writes, execute repository-defined linter tooling, and potentially execute shell commands if not restricted.\n - Sanitization: The skill relies on a human-in-the-loop review of the final diff rather than automated input sanitization.\n- [COMMAND_EXECUTION]: The skill operates by invoking the
aiderCLI and a Node.js relay script to perform its core task orchestration.\n- [EXTERNAL_DOWNLOADS]: The skill documentation directs users to install theaider-chatpackage from the standard Python Package Index (PyPI).
Audit Metadata