agent-relay-orchestrator
Pass
Audited by Gen Agent Trust Hub on Aug 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
agent-relayCLI via a global npm installation (npm i -g agent-relay). - [REMOTE_CODE_EXECUTION]: The setup instructions involve running
npx -y @agent-relay/openclaw@latest, which downloads and executes the latest version of the vendor's package from the npm registry. - [COMMAND_EXECUTION]: The skill provides instructions for spawning multiple agent types (Claude, Codex, Gemini, Droid) that execute shell commands and tasks. It specifically notes that Claude agents are run with
--permission-mode bypassPermissions, which disables security and permission prompts for those agents. - [INDIRECT_PROMPT_INJECTION]: The skill implements a multi-agent coordination environment where agents read from and post to shared channels and DMs.
- Ingestion points: Agents ingest data from the workspace via
agent-relay inboxandmcporter call relaycast get_messages(SKILL.md). - Boundary markers: The skill does not define specific delimiters or instructions to ignore embedded commands within the channel messages.
- Capability inventory: The orchestrator and spawned agents possess the ability to execute shell commands, spawn further agents, and communicate over the network (SKILL.md).
- Sanitization: There is no evidence of filtering or sanitization of messages received through the coordination channels.
Audit Metadata