Agent Design 2
Pass
Audited by Gen Agent Trust Hub on Mar 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTIONNO_CODE
Full Analysis
- [COMMAND_EXECUTION]: The documentation describes tools and structures that allow agents to execute arbitrary shell commands, such as the
Bashtool and MCP serverstartCommandandinstallCommandconfigurations.- [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of external software throughnpmDependencies,pipDependencies, andnpxcommands for fetching MCP servers like@anthropic-ai/mcp-server-filesystem.- [PROMPT_INJECTION]: The architecture relies on interpolating instructions into prompts for commands and subagents, creating a surface for indirect prompt injection when processing untrusted data. - Ingestion points: Agent memory files (
agentMDFile), workspace files, and outputs from tools or MCP servers. - Boundary markers: The documentation does not explicitly detail the use of delimiters or 'ignore' instructions to isolate data from instructions.
- Capability inventory: Includes
Bashtool, file modification (Write,Edit), and package installation. - Sanitization: No specific sanitization or validation logic is presented for handling external content within prompts.- [NO_CODE]: The skill consists entirely of markdown documentation and type definitions, containing no executable scripts or code to analyze directly.
Audit Metadata