dialectic

Pass

Audited by Gen Agent Trust Hub on Mar 11, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses shell commands such as mkdir, mv, and claude -p to orchestrate its workflow. The claude -p command is used to spawn subagents in fresh sessions to perform independent analysis, which is the primary mechanism for its 'Electric Monk' belief system.
  • [EXTERNAL_DOWNLOADS]: The skill fetches content from well-known and trusted sources. It uses curl to access the official Wikipedia API (en.wikipedia.org) for its lateral thinking features and recommends downloading its own configuration file from the author's verified GitHub repository using wget.
  • [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface as it ingests untrusted data from the web via web_search and web_fetch tools. This data is synthesized into a context_briefing.md file and subsequently processed by subagents. Boundary markers are partially implemented by wrapping content in a briefing document rather than direct interpolation into the orchestrator's primary prompt.
  • [SAFE]: No high-severity threats such as hardcoded credentials, data exfiltration to unknown domains, or persistent malicious scripts were detected. The skill's operations are transparently documented and consistent with its analytical purpose.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 11, 2026, 03:03 AM