soia-dev-agent-cli-dispatch
Warn
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The core functionality of the skill involves executing external CLI tools (e.g., Codex, Claude Code, Gemini) via shell commands. Specifically,
scripts/run_matrix.pyusessubprocess.run()withshell=Trueto execute command templates provided in a task manifest. This pattern is inherently sensitive as it grants the agent the ability to run arbitrary shell code. - [DYNAMIC_EXECUTION]: The skill assembles and executes shell commands dynamically based on templates stored in
cases.json. While the documentation emphasizes prompt injection protection by writing inputs to temporary files, the actual execution mechanism in the Python scripts relies on string-based command invocation. - [INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection as it ingests untrusted task descriptions and acceptance criteria from users to pass to external AI agents.
- Ingestion points: User-provided task objects and objective strings in
SKILL.mdanddispatch-contract.md. - Boundary markers: The skill uses task-based directory isolation and temporary files to separate inputs.
- Capability inventory: Extensive use of
subprocess.run, file writing to state directories, and network access mediated by external CLIs. - Sanitization: The skill implements a strategy of writing prompts to UTF-8 temporary files to avoid direct shell interpolation, though the final execution still occurs within a shell context.
- [DATA_EXFILTRATION]: The skill manages sensitive data, including model usage logs, cost estimates, and task manifests, within
~/.local/state/soia-skills/and~/.config/soia-skills/. It explicitly references access to local directories that may contain credentials (like.sshor.aws), although it labels these as 'Dangerous directories' to be handled with caution. - [EXTERNAL_DOWNLOADS]: The skill references external installation scripts and repositories, such as the official Antigravity CLI installer from Google's domain and the vendor's own repository on GitHub. These references are documented as standard setup procedures for the supported AI agents.
Audit Metadata