orchestrating-skills

Warn

Audited by Gen Agent Trust Hub on Oct 13, 2026

Risk Level: MEDIUMDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill dynamically modifies the Python module search path (sys.path) at runtime to load the remembering skill from absolute paths such as /mnt/skills/user/remembering or /home/user/claude-skills/remembering. This allows for the integration and execution of code components outside the skill's own package directory.
  • [INDIRECT_PROMPT_INJECTION]: The orchestrator ingests potentially untrusted context data and tasks, which are interpolated into multiple LLM prompts across the planning, execution, and synthesis phases.
  • Ingestion points: User-provided context and task strings are passed to the orchestrate function in scripts/orchestrate.py.
  • Boundary markers: The skill utilizes markdown headers (e.g., ## Task, ## Context) to structure prompts in scripts/assembler.py, but it does not provide explicit instructions to the models to ignore commands embedded within the context data.
  • Capability inventory: The skill can perform parallel network requests to the Anthropic API and execute database operations via a separate memory-management skill.
  • Sanitization: No escaping or filtering is applied to the input context before it is passed to the LLM subagents.
  • [COMMAND_EXECUTION]: The orchestrator employs concurrent.futures.ThreadPoolExecutor in scripts/client.py to handle parallel subagent execution and manage high-volume API requests.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Oct 13, 2026, 06:44 PM