5dive-cli
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill presents an entry surface for indirect prompt injection and shell interpolation due to its handling of external and cross-agent message payloads.\n
- Ingestion points: Data enters the agent's context through inter-agent messages (
5dive agent send/ask), task descriptions (5dive task add), and pulled repository code or pull request descriptors (5dive task deliver).\n - Boundary markers: The documentation explicitly warns that double-quoted bodies can execute backtick CLI verbs as command substitutions, advising the use of single quotes or the
--message-fileflag to encapsulate text boundaries.\n - Capability inventory: The agent has high capabilities, including the ability to spawn new administrative sibling processes via
sudo 5dive agent create, interact with active terminal panels, and write to GitHub repositories using5dive gh.\n - Sanitization: The instruction set provides guidelines on avoiding shell evaluation side-effects by using file-based arguments, but processing natural language inputs from external task creators remains an injection vector.\n- [DYNAMIC_EXECUTION]: The skill implements automated script generation and execution patterns to stand up runtime services.\n
- Evidence: The
5dive acpcommand automatically stages an embedded script (acp-server.ts) onto the local disk on invocation, then usesbunto execute the file dynamically for Agent Client Protocol communication bridges.
Audit Metadata