agency-agents-orchestrator
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The orchestrator ingests data from external project specification files and task lists to drive its autonomous workflow, which presents a surface for potential manipulation by untrusted input.
- Ingestion points: The skill reads external content from
project-specs/[project]-setup.mdandproject-tasks/[project]-tasklist.mdas part of its Phase 1, Phase 2, and Phase 3 logic inSKILL.md. - Boundary markers: The instructions do not define explicit delimiters (like XML tags or triple quotes) or specific "ignore embedded instructions" warnings when processing these files, which may lead to the agent obeying commands hidden within project specifications.
- Capability inventory: The skill has the ability to spawn a wide variety of specialist agents (Frontend, Backend, AI, DevOps, etc.) and execute shell commands including
ls,cat, andgrep(all documented inSKILL.md). - Sanitization: There is no evidence of sanitization, validation, or filtering of the external file content before it is interpolated into context or used to generate instructions for downstream agents.
Audit Metadata