trinity-remote
Warn
Audited by Gen Agent Trust Hub on Mar 5, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the Bash tool to execute commands that include user-supplied variables, such as webhook URLs and agent names. For instance, the
curlcommand for testing webhooks andgitcommands for deployment do not appear to sanitize these inputs, creating a risk for command injection. - [DATA_EXFILTRATION]: The notification feature allows users to configure a webhook URL. This creates a network egress point where data can be sent to an arbitrary external endpoint via POST requests.
- [PROMPT_INJECTION]: The skill's architecture presents an indirect prompt injection surface by processing untrusted user input and metadata and interpolating it into prompts sent to remote agents. \n
- Ingestion points: Command arguments for
execandrun, notification settings, and thetemplate.yamlfile. \n - Boundary markers: None identified; user inputs are directly interpolated into messages for the
mcp__trinity__chat_with_agenttool. \n - Capability inventory: The skill has access to the
Bashtool and remote communication tools. \n - Sanitization: There is no evidence of validation or escaping for user-provided strings before they are used in sensitive contexts.
Audit Metadata