ensemble-designer

Pass

Audited by Gen Agent Trust Hub on Oct 9, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSPERSISTENCEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill authors Python and Bash scripts for data processing and output verification. These scripts are dynamically generated and then executed using the test_script tool to validate their functionality before ensemble creation.
  • [EXTERNAL_DOWNLOADS]: The promotion workflow involves cloning the llm-orchestra-library repository from GitHub to facilitate the sharing and contribution of validated ensembles to a global library.
  • [PERSISTENCE]: The skill manages the promotion of ensembles by writing configuration files and model profiles to the user's global configuration directory at ~/.config/llm-orc/, enabling ensemble persistence across different projects and sessions.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests external data through ensemble-request and feedback artifacts. This creates an attack surface where maliciously crafted task descriptions or evaluation results could influence the logic of the scripts authored by the agent.
  • Ingestion points: Ensemble-request artifacts and feedback artifacts (via evaluations.jsonl).
  • Boundary markers: The instructions reference ADR-015 for artifact schemas, but no explicit sanitization prompts are present in the skill body.
  • Capability inventory: Includes create_script, test_script, Bash, Write, and Edit tools.
  • Sanitization: Relies on architectural judgment from the LLM and the mandatory user-approval invariant (Invariant 1) before any transition or action.
  • [COMMAND_EXECUTION]: The skill utilizes the Bash tool to test authored scripts and handle repository operations like cloning and pull request creation.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 9, 2026, 09:49 AM