orchestration-envelope
Pass
Audited by Gen Agent Trust Hub on Aug 22, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides an internal contract for agent orchestration, defining a JSON "envelope" and a "Turn Contract" to ensure consistent and verifiable repository operations.
- [REMOTE_CODE_EXECUTION]: The documentation references the NPM package
@gtrabanco/agentic-workflow-schema. This is identified as a vendor-owned resource corresponding to the skill author (gtrabanco) and is a legitimate dependency for the workflow's schema management. - [COMMAND_EXECUTION]: The turn contract includes instructions for the agent to execute standard
gitand GitHub CLI (gh) commands for branch management, commits, and pull request creation. These operations are standard for development-oriented skills. - [INDIRECT_PROMPT_INJECTION]: The skill defines a structured JSON output format for parsing by an external orchestrator. While the communication between the agent and orchestrator presents a potential surface for indirect injection, the skill defines clear boundary markers (triple backticks) and the schema is restricted to internal operational data.
Audit Metadata