bot-process-control
Warn
Audited by Gen Agent Trust Hub on Mar 8, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONCREDENTIALS_UNSAFEDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
bashto manage background services vialaunchctlandpkill. It provides templates to create and load persistentLaunchAgentsin the user's Library directory, which is a standard method for establishing persistence on macOS.\n- [CREDENTIALS_UNSAFE]: Explicitly identifies the location of sensitive Google OAuth access and refresh tokens at~/.claude/tools/gmail-tokens/. It also describes workflows for accessing client credentials stored in a 1Password vault.\n- [DATA_EXFILTRATION]: Provides commands to read the contents of OAuth token JSON files and audit logs usingcatandtail, which could expose authentication secrets or private user data if misused.\n- [PROMPT_INJECTION]: The skill exposes an attack surface for indirect prompt injection through the monitoring of application logs.\n - Ingestion points: Reads bot stderr logs and NDJSON audit logs via
tailandcat.\n - Boundary markers: None present for log file content.\n
- Capability inventory: Full
bashaccess, file manipulation, and process control vialaunchctl.\n - Sanitization: No validation or sanitization is performed on log content before it is processed or displayed.
Audit Metadata