multi-harness-debate
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The protocol defines an iterative process where an Orchestrator agent reads a 'Consolidated Version' of a document and transmits it to guest agents for review and voting. This process creates an ingestion point for potentially untrusted data that could contain instructions designed to influence the behavior of the participating agents.
- Ingestion points: The markdown document specified in the debate file (SKILL.md) containing the 'Current Consolidated Version'.
- Boundary markers: The protocol uses structured Markdown headers (e.g., '## Current Consolidated Version', '## Agent Debate Block') to separate content, which serves as a basic delimiter.
- Capability inventory: The skill involves executing external CLI tools (claude, copilot, codex) which have filesystem and network access capabilities.
- Sanitization: The skill mandates 'Strict Fact-Checking' (Section 4.1) and requires explicit human authorization before transmitting confidential data through external harnesses (Section 4.2).
- [COMMAND_EXECUTION]: The skill provides specific command-line instructions for the agent to invoke external AI harnesses. These include commands for Anthropic's Claude Code, GitHub Copilot CLI, and OpenAI Codex CLI. The instructions guide the agent to use shell-based interactions, including session resumption and file path passing (e.g., 'claude --resume /path/to/transcript.jsonl'), to manage the multi-agent context.
Audit Metadata