orchestration
Pass
Audited by Gen Agent Trust Hub on Mar 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The documentation includes instructions to install a plugin from an external source:
/plugin install team-agents@duyet-claude-plugins. This resource is associated with the author's namespace and is part of the intended setup for team coordination functions.\n- [COMMAND_EXECUTION]: The skill architecture spawns worker agents that are explicitly authorized to use system tools, includingBashand file-system commands (Read,Write,Edit), which are necessary for the primary purpose of task execution and codebase manipulation.\n- [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface because it ingests untrusted codebase data and user requests to generate instructions for sub-agents.\n - Ingestion points: Data is ingested when worker agents read local source code, analyze pull requests, or process external documentation during research phases (e.g., in
SKILL.mdandreferences/domains/research.md).\n - Boundary markers: The skill implements a 'WORKER preamble' designed to constrain sub-agents and define their operational boundaries.\n
- Capability inventory: Delegated worker agents have broad system access, including
Bashexecution and file-system write capabilities, to implement features or fix bugs across the project files.\n - Sanitization: The logic relies on descriptive prompt instructions to maintain safety and does not include programmatic sanitization or filtering of the content ingested from files or external requests before interpolation into sub-agent prompts.
Audit Metadata