agent-relay-orchestrator

Pass

Audited by Gen Agent Trust Hub on Aug 15, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill requires the installation of the agent-relay CLI via a global npm installation (npm i -g agent-relay).
  • [REMOTE_CODE_EXECUTION]: The setup instructions involve running npx -y @agent-relay/openclaw@latest, which downloads and executes the latest version of the vendor's package from the npm registry.
  • [COMMAND_EXECUTION]: The skill provides instructions for spawning multiple agent types (Claude, Codex, Gemini, Droid) that execute shell commands and tasks. It specifically notes that Claude agents are run with --permission-mode bypassPermissions, which disables security and permission prompts for those agents.
  • [INDIRECT_PROMPT_INJECTION]: The skill implements a multi-agent coordination environment where agents read from and post to shared channels and DMs.
  • Ingestion points: Agents ingest data from the workspace via agent-relay inbox and mcporter call relaycast get_messages (SKILL.md).
  • Boundary markers: The skill does not define specific delimiters or instructions to ignore embedded commands within the channel messages.
  • Capability inventory: The orchestrator and spawned agents possess the ability to execute shell commands, spawn further agents, and communicate over the network (SKILL.md).
  • Sanitization: There is no evidence of filtering or sanitization of messages received through the coordination channels.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 15, 2026, 10:32 PM
Security Audit — agent-trust-hub — agent-relay-orchestrator