ensemble-designer
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSPERSISTENCEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill authors Python and Bash scripts for data processing and output verification. These scripts are dynamically generated and then executed using the
test_scripttool to validate their functionality before ensemble creation. - [EXTERNAL_DOWNLOADS]: The promotion workflow involves cloning the
llm-orchestra-libraryrepository from GitHub to facilitate the sharing and contribution of validated ensembles to a global library. - [PERSISTENCE]: The skill manages the promotion of ensembles by writing configuration files and model profiles to the user's global configuration directory at
~/.config/llm-orc/, enabling ensemble persistence across different projects and sessions. - [INDIRECT_PROMPT_INJECTION]: The skill ingests external data through ensemble-request and feedback artifacts. This creates an attack surface where maliciously crafted task descriptions or evaluation results could influence the logic of the scripts authored by the agent.
- Ingestion points: Ensemble-request artifacts and feedback artifacts (via
evaluations.jsonl). - Boundary markers: The instructions reference ADR-015 for artifact schemas, but no explicit sanitization prompts are present in the skill body.
- Capability inventory: Includes
create_script,test_script,Bash,Write, andEdittools. - Sanitization: Relies on architectural judgment from the LLM and the mandatory user-approval invariant (Invariant 1) before any transition or action.
- [COMMAND_EXECUTION]: The skill utilizes the Bash tool to test authored scripts and handle repository operations like cloning and pull request creation.
Audit Metadata