ccf-pipeline-orchestrator
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements strong privacy boundaries in references/workflow-planning/intake-protocol.md, explicitly classifying material as public or private to prevent accidental exposure of sensitive research ideas.
- [SAFE]: File management is restricted to specific project-root directories (ccfa-workfiles/) and follows a 'Family File Contract' in SKILL.md that prevents data scattering or unauthorized access to sensitive system paths.
- [SAFE]: The instructions focus on planning and coordination without utilizing dangerous system commands, network operations, or external code execution.
- [INDIRECT_PROMPT_INJECTION]: While the skill ingests external artifacts and state files, it uses structured templates (e.g., in references/workflow-planning/design-brief-template.md) and explicit instructions to avoid inventing data, which mitigates risks associated with processing untrusted content.
Audit Metadata