delphi-dept
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
delphicommand-line utility to perform project orchestration, includingdelphi project list,delphi project new,delphi team list, anddelphi dept up. These commands are used to manage the project lifecycle and dispatch agent teams. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input to define project scope and generate deliverables, which could be exploited to influence agent behavior through crafted task descriptions.
- Ingestion points: User input is captured via the
$ARGUMENTSvariable inSKILL.mdand used to classify tasks and generate titles. - Boundary markers: There are no explicit delimiters or instructions provided to the agent to treat the user-supplied task description as untrusted content.
- Capability inventory: The skill possesses the ability to execute shell commands via the
delphiCLI and can launch background agent sessions. - Sanitization: The instructions do not specify any validation, escaping, or filtering of the user input before it is interpolated into commands or project stories.
Audit Metadata