computer-use
Warn
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes several shell and Python scripts during its operation, including
rubric-path.sh,resolve-route.py, andcodex-dispatch.sh. These scripts are used to resolve routing logic and dispatch tasks to executors. - [REMOTE_CODE_EXECUTION]: The execution paths for these scripts are not hardcoded. Instead, they are determined dynamically by checking the
CLAUDE_PLUGIN_ROOTenvironment variable or by performing a directory search in the user's home folder ($HOME/.claude/plugins/cache/*/harness/*/). Executing scripts from computed paths is a dynamic execution pattern that can be risky if the environment is manipulated. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon "Harness requests" and process findings from external workers ("reports"), which are untrusted data sources.
- Ingestion points: SKILL.md logic for processing incoming requests and worker reports.
- Boundary markers: Absent. The skill lacks explicit delimiters to separate instructions from untrusted data in the prompt interpolation process.
- Capability inventory: Includes shell command execution, file system writes to temporary directories, and "computer-use" capabilities (driving apps/browsers).
- Sanitization: The skill instructions advise the agent to treat reports as claims and manually verify results, providing a procedural but not a technical boundary.
Audit Metadata