spawn-worktree-agent
Pass
Audited by Gen Agent Trust Hub on Jul 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Executes shell scripts (
spawn.sh) and CLI tools (herdr,jq,lazygit) to manage workspaces and agents. - [PROMPT_INJECTION]: Indirect prompt injection surface identified.
- Ingestion points: User-provided task description (SKILL.md Step 2) is used to generate the worker's prompt.
- Boundary markers: The task is interpolated into a prompt template but lacks explicit instructions to the worker to ignore potential malicious instructions within the user input.
- Capability inventory: The spawned worker agent has the capability to modify code and execute commands within the isolated worktree; it is launched with
--dangerously-skip-permissionswhich removes the requirement for human-in-the-loop confirmation. - Sanitization: No validation or escaping is performed on the user-supplied task description before it is written to the temporary prompt file.
- [DATA_EXPOSURE]: The test script
scripts/test_spawn_e2e.shcontains a hardcoded absolute path (/Users/ricardo.quiroz/Developer/...) which reveals information about the author's local file system structure and username.
Audit Metadata