agentic-os
Warn
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: MEDIUMPERSISTENCEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PERSISTENCE]: The skill provides detailed templates and instructions for establishing persistence on host operating systems. It includes XML configuration for macOS
LaunchAgentsand INI files for Linuxsystemdtimers, designed to automatically launch the AI agent at scheduled intervals or system startup.\n- [INDIRECT_PROMPT_INJECTION]: The architecture relies on an 'Inbox' and 'Logs' pattern where the agent reads instructions and context from local files (e.g.,data/inbox/,data/logs/). \n - Ingestion points: Files located in
data/inbox/anddata/logs/are read to determine project status and next actions.\n - Boundary markers: The templates provided do not include explicit delimiters or instructions for the agent to ignore potentially malicious commands embedded within these data files.\n
- Capability inventory: The system is designed with full filesystem access, Git operations capability, and the ability to execute background scripts.\n
- Sanitization: There is no evidence of sanitization or validation of the content read from the
data/directory before it is processed by the agent kernel.\n- [COMMAND_EXECUTION]: The skill defines workflows that involve the execution of shell commands and scripts, including Git operations and the invocation of daemons within thescripts/directory.
Audit Metadata