delphi-seat
Warn
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to run the command
delphi seat $1 --json. Because the$1argument is interpolated directly into the shell command without quoting or sanitization, an attacker providing an argument with shell metacharacters (such as;,|, or&) could execute arbitrary commands in the agent's environment. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to load and follow instructions from external and dynamic sources, which could be exploited to manipulate the agent.
- Ingestion points: The agent is directed to read
.delphi/PROTOCOL.mdand the output from thedelphicommand into its active context. - Boundary markers: No delimiters or safety instructions are provided to separate these external inputs from the agent's primary system instructions.
- Capability inventory: The agent has permissions to execute shell commands, read local files, and send messages to other agent seats.
- Sanitization: The skill does not describe any mechanisms for validating the input argument or filtering the content of ingested files.
Audit Metadata