orchestrating-agent-relay
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on numerous shell commands to bootstrap infrastructure (
agent-relay node up), manage worker lifecycles (agent-relay node agent spawn), and coordinate messaging.\n- [EXTERNAL_DOWNLOADS]: Instructions include downloading theagent-relaypackage vianpm install -gornpx. These are vendor-provided tools from the skill authoragentworkforce.\n- [DYNAMIC_EXECUTION]: The skill generates and executes a Python script via a heredoc to parse JSON output from the fleet nodes command.\n- [INDIRECT_PROMPT_INJECTION]: The orchestrator agent processes output from worker agents (viacheck_inboxandlist_messages) and broker events.\n - Ingestion points: Reads worker DMs and channel messages using the Agent Relay MCP server.\n
- Boundary markers: Absent. The instructions do not specify delimiters or explicit instructions to ignore embedded commands in worker-generated content.\n
- Capability inventory: The orchestrator has the ability to spawn agents, execute shell commands, and install packages.\n
- Sanitization: Absent. No filtering or validation of worker messages is implemented before the orchestrator processes the data.
Audit Metadata