using-orq-lite
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends installing two optimization utilities,
rtkvia Homebrew andheadroom-proxyvia NPM, which are used as hooks to reduce token usage in agent calls. - [COMMAND_EXECUTION]: The skill documents the
command.run@1activity, which allows users to define shell commands that the workflow engine executes to perform tasks like linting or building maps. - [DYNAMIC_EXECUTION]: Workflow logic utilizes a
$refsyntax to dynamically wire the outputs of shell commands or subflows into the prompts of other agents at runtime. - [INDIRECT_PROMPT_INJECTION]: By design, the workflow engine ingests data from external command outputs and file content into agent prompts, creating a surface where malicious input in those sources could influence agent behavior.
Audit Metadata