team-agent-orchestration
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONNO_CODE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines a system where an orchestrator agent processes data (handoff artifacts, acceptance criteria, and review notes) generated by other agents. This creates a trust-chain vulnerability where a compromised or malicious agent in the squad could inject instructions into these artifacts to influence the orchestrator's behavior.
- Ingestion points: Data enters the orchestrator's context via
handoff.mdfiles and JSON-formatted agent cards in the Kanban system (SKILL.md). - Boundary markers: The skill uses status columns and schema definitions, but lacks explicit instructions to treat incoming agent data as untrusted or to sanitize embedded directives.
- Capability inventory: The orchestration process manages file operations, branch isolation, and tool execution across multiple worktrees.
- Sanitization: There are no documented procedures for escaping or filtering the content of handoff notes or task outputs before they are processed by the lead agent.
- [NO_CODE]: The skill is entirely instructional and does not include any scripts, executable commands, or configuration files that perform automated actions.
Audit Metadata