tianya-gods-team
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The installation script (
install.sh) and the verification script (test.sh) perform standard local operations, such as creating directories within the user's home folder (~/.stepclaw) and establishing symbolic links in~/.local/binto provide CLI access to the orchestrator. - [EXTERNAL_DOWNLOADS]: The documentation and README reference official GitHub repositories and websites for established technology providers and academic institutions, including OpenAI (Swarm), Microsoft (AutoGen), and the University of Hong Kong (ClawTeam). These are documented as well-known and trusted sources.
- [INDIRECT_PROMPT_INJECTION]: The skill acts as a coordinator that interpolates user queries into prompts for multiple simulated personas. While this creates a data ingestion surface, the risk is negligible as the provided Python logic is restricted to terminal output without network, file-write, or shell-execution capabilities.
- Ingestion points: User queries provided via command-line arguments or skill triggers.
- Boundary markers: The framework uses a structured report format to delimit different agent outputs.
- Capability inventory: The orchestration script (
team-orchestrator.py) is limited to text formatting and standard output. - Sanitization: No specific input filtering is implemented in the orchestration logic.
Audit Metadata