orchestrate-herdr
Pass
Audited by Gen Agent Trust Hub on Jul 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a user-provided coding CLI command (
CODING_CLI) in parallel worker tabs. It implements safety checks by verifying the base binary (CLI_NAME) exists on the system PATH and explicitly requiring user confirmation for the execution's permission mode. - [EXTERNAL_DOWNLOADS]: Fetches data from GitHub issues and sub-issues using the
gh apiandgh issue viewcommands. This communication is restricted to the well-known GitHub service and is used for task discovery rather than executable code retrieval. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) because it ingests and processes content from external GitHub issues.
- Ingestion points: Reads issue bodies and sub-issue data from GitHub repositories (SKILL.md, Section 2).
- Boundary markers: Absent; there are no explicit delimiters or instructions to ignore embedded commands within the fetched issue text.
- Capability inventory: Launches user-defined CLI processes, creates workspace tabs, and writes text to shell prompts (SKILL.md, Section 3-4).
- Sanitization: None; the skill passes issue content directly to worker agents. However, the orchestrator itself does not execute this data as shell commands, acting only as a pass-through to sub-workers.
Audit Metadata