work-with
Pass
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses local shell commands (bash, jq, bc, sed, tr) and Python one-liners to perform state management, mathematical synchronization score calculations, and message dispatching. It specifically utilizes the GitHub CLI (gh) for issue-based anchoring and the 'maw' tool for cross-agent messaging.
- [EXTERNAL_DOWNLOADS]: The skill interacts with GitHub's public API through the
ghtool to view and comment on issues. These operations are limited to metadata retrieval and documentation within well-known project management contexts. - [PROMPT_INJECTION]: The skill has an indirect prompt injection surface (Category 8) because it processes data from external sources such as GitHub issue comments and incoming synchronization messages.
- Ingestion points: Data enters the context via GitHub comments retrieved by
gh issue viewand protocol messages (SYNC-RESULT, PARTY INVITE) received via themaw heycommand. - Boundary markers: The implementation uses specific protocol headers (e.g., SYNC-CHECK, SYNC-RESULT) and structured JSON schemas to delineate messages.
- Capability inventory: Capabilities include writing to specified memory directories and sending messages to other oracles.
- Sanitization: Data is filtered and parsed using
jqand standard string manipulation tools, which limits the potential for executing arbitrary instructions from external content.
Audit Metadata