chief-autopilot
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted data from the .chief/ directory to guide its autonomous behavior, creating an indirect prompt injection surface. * Ingestion points: Files located in .chief/_goal/, .chief/_contract/, and .chief/_rules/. * Boundary markers: Absent; there are no instructions to the agent to distinguish between its system instructions and the data found in these files. * Capability inventory: The agent modifies the local file system (_plan/_todo.md and report files) and delegates implementation tasks to a separate 'builder-agent'. * Sanitization: Absent; the content of the goal and contract files is used directly without validation or escaping.
- [COMMAND_EXECUTION]: The 'auto mode' configuration instructs the agent to make decisions autonomously and explicitly bypass human confirmation ('NEVER stop for human input'). This design increases the risk that instructions injected into goal or contract files could lead to the autonomous execution of unauthorized operations via the builder-agent.
Audit Metadata