multi-codex-orchestrator
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on shell scripts (e.g., spawn_agents.sh, collect_results.sh, merge_patches.sh) to manage parallel worker agents. These scripts perform file system operations, use git worktree to create isolated project views, and invoke codex exec to launch sub-agents. These actions are consistent with the skill's purpose as a development orchestrator.
- [EXTERNAL_DOWNLOADS]: The README.md file contains installation instructions that reference a repository hosted on GitHub. This is a standard method for distributing and installing AI agent skills.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-defined configurations from a plan.yaml file and renders them into prompt templates for sub-agents. * Ingestion points: The scripts/spawn_agents.sh script parses user-editable fields such as goal, role, and paths from the plan.yaml file. * Boundary markers: The extracted data is interpolated into the assets/templates/agent-task.md template using sed. The template does not utilize explicit delimiters or specialized instructions to prevent the sub-agents from interpreting user-provided text as system-level commands. * Capability inventory: The sub-agents launched by this skill have the authority to perform git operations and modify files within their designated paths. * Sanitization: The skill employs escaping for sed-specific characters to ensure the technical integrity of the shell command during template rendering, but it does not perform semantic sanitization of the content to mitigate prompt injection risks.
Audit Metadata