stream
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes a local binary at the fixed path ${CLAUDE_PLUGIN_ROOT}/bin/helix to manage stream state and server processes. This usage is restricted to the pre-approved path and is central to the skill's purpose.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon steering notes provided by the user via the dashboard. While this represents a surface for external instructions to reach the agent, it is an intentional design for human-in-the-loop steering.
- Ingestion points: User notes and brake actions are retrieved using the helix stream wait command from the session event logs.
- Boundary markers: The instructions do not prescribe specific delimiters or safety wrappers for user-provided notes, as they are intended for direct guidance.
- Capability inventory: Shell tool access is scoped specifically to the helix binary in the plugin root.
- Sanitization: User steering input is processed as instruction text without additional sanitization layers described.
Audit Metadata