fleet
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and summarizes session status data.
- Ingestion points: The agent context is populated by the output of the
${CLAUDE_PLUGIN_ROOT}/bin/helix fleet statuscommand. - Boundary markers: No explicit delimiters or boundary markers are defined to isolate session-supplied data (such as titles, labels, or slugs) from the agent's instructions.
- Capability inventory: The skill is authorized to execute shell commands via the
helixbinary using Bash and PowerShell. - Sanitization: No sanitization or filtering of session-provided metadata is described before processing.
- [COMMAND_EXECUTION]: The skill executes a vendor-provided CLI utility to manage local server state and query JSON registries.
- Evidence: The skill calls
${CLAUDE_PLUGIN_ROOT}/bin/helix fleet upand${CLAUDE_PLUGIN_ROOT}/bin/helix fleet statusacross multiple platforms.
Audit Metadata