✓prompt-injectionSKILL.md and both hooks frame comment, feed and hand-off text from the sources as data, never instructions; hand-off blocks escape a closing tag. The 2026-11-03 rewrite of the description (RMA-247) only drops quoted Russian phrases; it adds no directive and no new behaviour. 2026-11-03 (RMA-213, RMA-214): the body now names the gone row group and tells the agent to answer a pasted hand-off from the hand-off and the monitor rather than the trackers; no directive that widens access.
✓data-exfiltrationAll calls go to the monitor on 127.0.0.1. The only off-box send is a bug or idea report the user asks for, which the monitor files into a Linear project it is configured with; disclosed in metadata.yaml.
✓secret-detectionNo key or token in the skill, scripts or fixtures; a token the user pastes goes to the local monitor on stdin, never on a command line or into config.
✓dangerous-commandsNo destructive shell. The scripts run npm install into the monitor's own data directory, launchctl/systemctl start of the user's own agent, and the package's install.sh/open.sh.
✓obfuscationPlain Node and markdown; nothing encoded or eval'd.
✓external-fetchesbin/app.mjs installs the published whose-turn npm package from the npm registry with --ignore-scripts and runs it: the first start takes `latest` (WHOSE_TURN_APP_VERSION names another version), and after that the server updates itself from the `latest` dist-tag; the SessionStart hook starts an available update and says so on its line. Unpinned by design and disclosed in README, plugin.json and metadata.yaml; npm checks each tarball's integrity, and releases carry provenance from the package's own GitHub Actions workflow.
✓credential-accessNo read of ~/.ssh, ~/.aws, .env, a keychain or a token store.
✓privilege-escalationNo sudo or setuid. app.mjs install, run on the user's request, registers a per-user launchd agent or systemd user unit (the monitor's declared start-at-login); the SessionStart hook only repoints an agent the user already registered when its server.mjs is gone or outdated. Disclosed in metadata.yaml.