orchestrating-agent-relay
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONPERSISTENCE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user or agent to install the 'agent-relay' CLI tool globally via 'npm install -g agent-relay' or run it using 'npx'. These are legitimate downloads from official registries for the vendor's primary tooling.\n- [COMMAND_EXECUTION]: The skill requires the execution of various shell commands to bootstrap and manage the relay infrastructure, including starting background daemons, spawning new agent processes, and monitoring system metrics.\n- [PERSISTENCE]: The documentation describes the use of a macOS LaunchAgent ('com.agentrelay.fleet-node') to ensure that fleet nodes remain active and reconnect automatically after system reboots. This is an intended feature for persistent agent infrastructure.\n- [INDIRECT_PROMPT_INJECTION]: The orchestrator agent is instructed to read and process messages from worker agents, creating an attack surface for indirect prompt injection.\n
- Ingestion points: Data enters the agent context through 'check_inbox', 'list_messages', and 'get_message_thread' MCP tools, which retrieve messages sent by potentially untrusted worker agents.\n
- Boundary markers: The skill does not define specific delimiters or instructions to ignore embedded commands within worker messages.\n
- Capability inventory: The orchestrator has the ability to execute shell commands, spawn new agent processes, and perform network-based messaging.\n
- Sanitization: No explicit sanitization or validation steps are provided for worker-generated content before it is processed by the orchestrating agent.
Audit Metadata