oss-forensics-orchestration
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted content from public GitHub repositories (commits, PRs, issues), which are acknowledged as adversarial sources. It implements several mitigations:
- Ingestion points: External data enters through multiple investigator agents (GitHub API, GH Archive, Wayback Machine).
- Boundary markers: Explicit instructions define an 'Untrusted-content envelope' where the agent is told to ignore embedded directives like 'ignore previous instructions'.
- Capability inventory: The skill can spawn specific investigator agents and write to a local working directory.
- Sanitization: An 'Agent-name allowlist' is enforced in the orchestration loop to ensure only authorized agents can be spawned, even if an LLM-generated request is influenced by adversarial data.
- [COMMAND_EXECUTION]: The skill executes local scripts for initialization and workflow management:
- Runs
init_investigation.pyusing Python3 to set up the working directory and verify credentials. - Executes
libexec/raptor-may-askto determine if user interaction is required for scope clarification.
Audit Metadata