aiox-analyst
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONPRIVILEGE_ESCALATION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Node.js script (
.aiox-core/development/scripts/unified-activation-pipeline.js) as a fallback mechanism during its activation sequence. It also includes logic to suggest environment bootstrap commands if a git repository is not detected in the current workspace. - [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect instructions by ingesting data from external files within the project environment.
- Ingestion points: The agent reads story documentation from
docs/stories/and workflow handoff artifacts from.aiox/handoffs/to populate its greeting and suggest command chains. - Boundary markers: No specific delimiters or "ignore embedded instructions" warnings are defined when these external data sources are interpolated into the agent's context.
- Capability inventory: The agent can execute local JavaScript files, perform web research using the
exatool, and modify the state of handoff files by marking them as consumed. - Sanitization: The skill lacks evidence of sanitization or validation of the content found within the ingested YAML and Markdown files.
- [DYNAMIC_EXECUTION]: The skill references and executes local JavaScript files, such as
pattern-extractor.js, to perform analysis tasks on the codebase at runtime. - [PRIVILEGE_ESCALATION]: The skill implements a
*yolocommand designed to cycle through permission modes (ask,auto,explore). This allows for the reduction of user oversight by enabling modes that bypass manual confirmation requirements for tool execution.
Audit Metadata