orchestrate-issues
Pass
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and processes external data from issue trackers and Markdown files which directly influence the orchestration logic and the instructions dispatched to subagents.
- Ingestion points: Reads
issues/BACKLOG.md,issues/ARCHIVE.md, and individual issue files (issues/NNN-*.md). - Boundary markers: The dispatch prompt template for workers lacks explicit delimiters or instructions to ignore embedded instructions within the issue content.
- Capability inventory: The skill performs file system writes (updating the backlog, archiving rows, patching docs) and executes shell commands (test runners and app startup) based on project configuration.
- Sanitization: There is no evidence of sanitization or validation of the Markdown content before it is used to interpolate prompts or influence workflow decisions.
- [COMMAND_EXECUTION]: The skill executes project-specific shell commands to verify implementation progress and perform acceptance testing.
- Evidence: It instructs the agent to run "the project's test command" and launch the application using instructions from the README or smoke scripts. This is a functional requirement for verifying that issues are correctly implemented, but it represents an execution surface for project-defined code.
Audit Metadata