The Markdown backtick findings are false positives because they are documentation, not executable Ruby or shell code. Real concerns remain around external hosted handoff instructions, Relay network traffic, workspace tokens, and worker delegation.
The skill tells agents to use https://agentrelay.com/skill before role selection and passes that instruction to spawned workers. The remote page can change after audit and deliver unaudited instructions.
The instruction to use a hosted handoff is explicit, and spawned workers are told to follow it. Remote content is outside the reviewed file.
External Relay Messaging May Expose Sensitive Context
The skill guides agents to use workspace keys, tokens, DMs, channel posts, inbox checks, and an external Relay gateway. Task details and project context may leave the local environment.
The file directly documents workspace keys, agent tokens, message commands, inbox checks, and an external gateway endpoint.
Worker Spawning Can Delegate Tasks Beyond Current Session
The skill documents provider-backed worker spawning and CLI worker lifecycle operations. Delegation can spread prompts, task context, and review data to additional agents.
The file explicitly describes add_agent and CLI spawn, tail, attach, and release workflows for new workers.
04
是正措置
この監査で推奨される修正が記録されています。これらを適用する責任はメンテナーにあります。
FIX-001
高
Unpinned remote handoff page
Vendor the handoff instructions into the skill, or pin the remote content to a reviewed version with integrity checks.
FIX-002
中
External Relay data flow
Document what data is sent to Relay, and warn users not to send secrets or regulated data without approval.
FIX-003
中
Worker spawning and action invocation
Require explicit user authorization before spawning workers or invoking Relay actions, and keep task scopes minimal.
FIX-004
低
Hardcoded external gateway
Make external endpoints configurable and document trusted Relay domains.