fleet-roles
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs repository lanes to read and follow 'repository's own instructions' before performing edits, creating a surface for instructions embedded in external data to influence agent behavior.
- Ingestion points: Target repository instructions and planner backlog logs described in the 'Tier 2 — repo lanes' and 'Tier 1 — management' sections.
- Boundary markers: No specific delimiters or safety instructions are provided to distinguish repository-supplied instructions from the skill's own operational rules.
- Capability inventory: Agents possess the ability to perform file edits, push code, open pull requests, and execute verification commands (e.g., re-running stated commands).
- Sanitization: The skill does not mention any validation or filtering of the instructions read from external repositories.
- [COMMAND_EXECUTION]: The documentation references a suite of management commands (e.g.,
fleet blockers,fleet verdicts,fleet register,fleet hb) implemented inscripts/fleet.mjs. These scripts are used for operational tasks such as monitoring heartbeat, checking registry status, and verifying merge conditions.
Audit Metadata