sub-agent-orchestrator
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The orchestrator enables workflows where output from external tools (like WebSearch) or user inputs are interpolated directly into agent prompts using '{{variable}}' templates. This creates an attack surface where data can be used to manipulate agent instructions.
- Ingestion points: Workflow YAML files, natural language requests, and results from tool-using agents (e.g., the 'researcher' agent).
- Boundary markers: The execution engine performs string replacement without using specific delimiters or safety instructions to prevent the model from obeying instructions embedded in the data.
- Capability inventory: The orchestrator manages agents with access to powerful tools including 'Bash', 'Write', and 'Agent' (for recursive calls).
- Sanitization: The documentation does not specify any sanitization or escaping mechanisms to protect against malicious payloads in interpolated strings.
- [DYNAMIC_EXECUTION]: The core functionality involves parsing YAML at runtime to build execution graphs, evaluate conditional logic, and dynamically construct prompt environments for child agents.
- [COMMAND_EXECUTION]: Agents within a workflow can be configured with 'Bash' tool access. The lack of sanitization when variables are interpolated into prompts for agents using shell tools creates a risk of command injection from untrusted data sources.
Audit Metadata