confer
Pass
Audited by Gen Agent Trust Hub on Jul 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes local command-line interfaces for Claude and Codex. This is necessary for its primary function of model consultation. The implementation uses secure process spawning methods in
scripts/confer.mjsthat prevent shell injection by passing arguments in an array and using the '--' delimiter to isolate user-provided prompts from command flags.\n- [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface (Category 8) because it processes responses generated by external AI models. \n - Ingestion points: Responses from peer models are ingested via the
claudeandcodexadapters inscripts/confer.mjs.\n - Boundary markers: Conversations are logged in markdown files with clear headers (e.g., '## R1 ← claude') to distinguish between different models and rounds.\n
- Capability inventory: The host agent using the skill typically has broad system permissions.\n
- Sanitization: The skill relies on the agent's internal safety filters and explicit markdown instructions in
SKILL.mdto evaluate external content safely and treat it as advisory.\n- [DATA_EXFILTRATION]: Conversation transcripts are stored in plaintext within the user's home directory (~/.confer/). The skill explicitly warns against including credentials or secrets in prompts to mitigate the risk of accidental exposure of sensitive information in these logs.
Audit Metadata