agent-runtime-integration
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEPERSISTENCECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [PERSISTENCE]: The skill describes the installation of a macOS LaunchAgent to perform periodic maintenance tasks, such as settling unfinished runs and cleaning up old records in the
~/.moru/directory every 24 hours. This behavior is documented as a core feature of the environment management system. - [COMMAND_EXECUTION]: The instructions involve the execution of multiple internal Python utility scripts (e.g.,
setup-agent-hooks.py,workflow.py,agent-entry.py) to manage the integration lifecycle. It provides specific guidance for configuring shell command execution within agent runtimes (Claude, Codex, Gemini/AGY), explicitly mandating the use of absolute paths and parameter-free permission allowlists to prevent unauthorized command execution or argument-based bypasses. - [INDIRECT_PROMPT_INJECTION]: The skill identifies potential attack surfaces where untrusted data could enter the agent's context, specifically through the 'agent-mailbox' cross-agent communication feature and the processing of external 'required_docs'.
- Ingestion points: Untrusted data enters via mailbox messages (
agent-mailbox receive) and external documentation files referenced in the workflow route. - Boundary markers: The instructions explicitly warn that mailbox briefs are 'context, not authority' and that the agent's normal lifecycle and user requests must still govern actions.
- Capability inventory: The agent possesses file editing and shell execution capabilities through its integrated runtime tools (e.g., Claude's Bash or Codex's unified exec).
- Sanitization: The skill utilizes 'VibeGuard' as a mandatory safety gate and rule source to audit and validate commands before execution.
Audit Metadata