aiox-wave-execute
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted markdown data from external files which are used to drive subagent actions.\n
- Ingestion points: Markdown story files (e.g., path1.md, path2.md) defined in SKILL.md and passed to the execution logic.\n
- Boundary markers: Absent; the skill does not define strict delimiters or 'ignore' instructions to prevent the subagent from executing commands embedded within the story files.\n
- Capability inventory: SKILL.md describes significant capabilities including subprocess execution via the aiox CLI and recursive task dispatching using spawn_subagent.\n
- Sanitization: Absent; while the skill mentions intent scanning, there is no technical detail on how it escapes or validates the content of the markdown stories before processing.\n- [COMMAND_EXECUTION]: The skill invokes the aiox CLI for workflow planning and state management. The inclusion of a 'yolo' mode allows these commands to run without user oversight, increasing the impact of any malicious arguments or story content.\n- [DYNAMIC_EXECUTION]: The skill dynamically generates instructions for subagents by interpolating story paths and execution parameters into spawn_subagent prompts as seen in the Stage 3 dispatch protocol.
Audit Metadata