agency-orgscript-engineer
Pass
Audited by Gen Agent Trust Hub on Jul 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute specific CLI tools and scripts including
orgscript format,orgscript validate,orgscript check, andorgscript export. It also references the execution of a JavaScript tool located atbin/orgscript.js. These tools are part of the vendor's intended functionality for the OrgScript language. - [PROMPT_INJECTION]: The skill processes untrusted external data (SOPs or business logic requirements) which presents an indirect prompt injection surface. 1. Ingestion points: Plain text SOPs and business logic requirements are ingested as specified in the workflow section of
SKILL.md. 2. Boundary markers: The instructions do not define specific delimiters or guidelines to ignore instructions embedded within the processed data. 3. Capability inventory: The agent is empowered to execute file formatting, validation, and export commands. 4. Sanitization: No explicit instructions are provided for sanitizing or escaping the content of the ingested data before processing.
Audit Metadata