openwolf
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions for installing and running the
openwolfCLI tool, which performs significant system interactions including project scanning and hook registration. - Core commands like
openwolf initandopenwolf scanmodify the project's.claude/settings.jsonand manage local state files in the.wolf/directory. - The
openwolf dashboardcommand initiates a local web server on port 18791. - The
openwolf designqccommand utilizespuppeteer-coreto capture screenshots of local development environments for design review. - [DYNAMIC_EXECUTION]: The middleware functions by generating and executing Node.js scripts at runtime to intercept Claude Code's tool calls.
openwolf initwrites six JavaScript hook scripts (e.g.,pre-read.js,post-write.js) to the.wolf/hooks/directory.- These scripts are executed as subprocesses by the agent platform during the file read/write lifecycle.
- [PERSISTENCE]: The tool includes features for maintaining long-running background processes and scheduled tasks.
- The
openwolf daemoncommand facilitates background operation, optionally utilizing the PM2 process manager. - A cron system is described for executing periodic maintenance tasks, such as anatomy rescans and AI memory reflections.
- [INDIRECT_PROMPT_INJECTION]: The tool's design centers on injecting content from project-specific files into the agent's prompt context to optimize token usage.
- Ingestion points: Data is read from
.wolf/anatomy.md,.wolf/cerebrum.md, and.wolf/buglog.jsonduring theSessionStartandPreToolUseevents. - Boundary markers: The documentation does not explicitly detail the use of XML delimiters or specific 'ignore' instructions for the injected summaries.
- Capability inventory: The skill's environment includes capabilities for file system modification, background process management, and browser-based screenshot capture.
- Sanitization: There is no mention of sanitization processes for the markdown content before it is emitted into the active context.
Audit Metadata