skills/wbunker/skills-repo/openwolf/Gen Agent Trust Hub

openwolf

Pass

Audited by Gen Agent Trust Hub on Oct 12, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides instructions for installing and running the openwolf CLI tool, which performs significant system interactions including project scanning and hook registration.
  • Core commands like openwolf init and openwolf scan modify the project's .claude/settings.json and manage local state files in the .wolf/ directory.
  • The openwolf dashboard command initiates a local web server on port 18791.
  • The openwolf designqc command utilizes puppeteer-core to capture screenshots of local development environments for design review.
  • [DYNAMIC_EXECUTION]: The middleware functions by generating and executing Node.js scripts at runtime to intercept Claude Code's tool calls.
  • openwolf init writes six JavaScript hook scripts (e.g., pre-read.js, post-write.js) to the .wolf/hooks/ directory.
  • These scripts are executed as subprocesses by the agent platform during the file read/write lifecycle.
  • [PERSISTENCE]: The tool includes features for maintaining long-running background processes and scheduled tasks.
  • The openwolf daemon command facilitates background operation, optionally utilizing the PM2 process manager.
  • A cron system is described for executing periodic maintenance tasks, such as anatomy rescans and AI memory reflections.
  • [INDIRECT_PROMPT_INJECTION]: The tool's design centers on injecting content from project-specific files into the agent's prompt context to optimize token usage.
  • Ingestion points: Data is read from .wolf/anatomy.md, .wolf/cerebrum.md, and .wolf/buglog.json during the SessionStart and PreToolUse events.
  • Boundary markers: The documentation does not explicitly detail the use of XML delimiters or specific 'ignore' instructions for the injected summaries.
  • Capability inventory: The skill's environment includes capabilities for file system modification, background process management, and browser-based screenshot capture.
  • Sanitization: There is no mention of sanitization processes for the markdown content before it is emitted into the active context.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 12, 2026, 09:55 AM