orchestrate
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill ingests untrusted user input through the
$ARGUMENTSplaceholder to drive task decomposition and subagent creation without sufficient isolation. - Ingestion points: The
$ARGUMENTSvariable inSKILL.mdis used to receive the primary task description from the user. - Boundary markers: There are no explicit delimiters (e.g., XML tags or triple backticks) or "ignore embedded instructions" warnings surrounding the interpolated user content.
- Capability inventory: The skill manages high-capability tools, including shell access (
Bash), file system modification (Write,Edit), and subagent lifecycle management (TaskCreate,TaskUpdate). - Sanitization: The instructions do not define any validation or filtering mechanisms to process the user-provided task description before it is analyzed and acted upon by the orchestrator.
Audit Metadata