herdr-orchestra
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill acts as an intermediary orchestrator, ingesting data from worker agents and user-provided files, which constitutes a vulnerability surface for indirect prompt injection.
- Ingestion points: Untrusted data enters the agent context through worker output reads and caller-supplied assignment text as described in references/delegation.md.
- Boundary markers: The skill mandates the use of distinct heredoc identifiers and non-colliding wait markers to isolate data from instructions in shell commands.
- Capability inventory: The skill possesses extensive system interaction capabilities via the herdr CLI, including subprocess spawning and prompt delivery to other agents.
- Sanitization: Explicit instructions prohibit the use of eval-like constructs (e.g., Invoke-Expression) and require passing assignments as literal data tokens to prevent command re-parsing.- [COMMAND_EXECUTION]: The skill provides instructions for executing shell commands and scripts to manage the Herdr environment.
- Evidence: references/patterns-and-recovery.md provides multiple POSIX and PowerShell snippets for agent and pane management.
- Context: These commands are the intended primary function of the skill, and the documentation includes substantial guidance on executing them securely without compromising shell integrity.
Audit Metadata