squad-explore
Pass
Audited by Gen Agent Trust Hub on Jun 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local Python scripts (
../squad/scripts/observe.py) and standard utilities likejqto handle telemetry, UUID generation, and JSON payload construction for API calls. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection. It utilizes an 'Explore' subagent to read arbitrary files from the codebase and then interpolates those findings directly into the prompt of a 'Plan' subagent. Malicious instructions placed in code comments or configuration files could influence the planning phase.
- Ingestion points: Project source files,
package.json, and configuration files read during the exploration phase (Step ②). - Boundary markers: Absent. The prompt for the Plan subagent does not use delimiters or instructions to ignore potential commands embedded within the exploration findings.
- Capability inventory: The skill has the capability to create and modify tasks/epics via an API and execute shell commands (Step ⓪, ④, ⑤).
- Sanitization: None. The raw output from the exploration subagent is passed directly into the next agent's context.
Audit Metadata