agent-adaptive-coordinator
Warn
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The pre and post hooks in SKILL.md execute shell commands that directly interpolate environment variables such as $TASK, $TASK_ID, and $SWARM_ID. Specifically, the command
mcp__claude-flow__neural_patterns analyze --operation="workload_analysis" --metadata="{\"task\":\"$TASK\"}"embeds the task description into a JSON string within a CLI argument. If the task description contains shell metacharacters or command substitution patterns (e.g.,$(command)), it could result in arbitrary command execution in the environment where the hook runs. - [INDIRECT_PROMPT_INJECTION]: The skill processes external task data and passes it to system-level tools, creating an injection surface.
- Ingestion points: The $TASK variable in the SKILL.md hooks.
- Boundary markers: Absent; the variable is interpolated directly into shell strings.
- Capability inventory: Shell command execution via various mcp__claude-flow__ tools and file system operations via mcp__claude-flow__model_save.
- Sanitization: No sanitization or escaping of the environment variables was detected before their use in shell execution.
Audit Metadata