xy-dispatch
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process feedback from external sources (Lark/Feishu documents and chat messages) which could be controlled by third parties.\n
- Ingestion points: Processes content from Lark documents (via lark-doc) and user-provided chat transcripts.\n
- Boundary markers: The skill contains robust instructional defenses, explicitly telling the agent to treat external content as data and ignore any embedded instructions (e.g., requests to change owners, expand authorization, or execute commands).\n
- Capability inventory: The agent can execute a local state management script (scripts/dispatch.py) and interact with enterprise messaging tools.\n
- Sanitization: Relies on LLM-level instruction to distinguish between task data and administrative commands.\n- [COMMAND_EXECUTION]: The skill requires the execution of a local Python script to maintain the task state machine.\n
- Evidence: Instructions in SKILL.md direct the agent to run scripts/dispatch.py for registering, revising, and transitioning tasks. The scripts/test_dispatch.py file also uses subprocess.run to invoke this script during testing.\n- [DATA_EXFILTRATION]: The skill accesses personnel information stored in local markdown files.\n
- Evidence: The instructions guide the agent to read files from paths such as ~/clients/demo/team/ to evaluate personnel capabilities before assigning tasks. While these are not system credentials, they contain potentially sensitive personnel data.
Audit Metadata