orchestrating-skills
Warn
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill dynamically modifies the Python module search path (
sys.path) at runtime to load therememberingskill from absolute paths such as/mnt/skills/user/rememberingor/home/user/claude-skills/remembering. This allows for the integration and execution of code components outside the skill's own package directory. - [INDIRECT_PROMPT_INJECTION]: The orchestrator ingests potentially untrusted context data and tasks, which are interpolated into multiple LLM prompts across the planning, execution, and synthesis phases.
- Ingestion points: User-provided
contextandtaskstrings are passed to theorchestratefunction inscripts/orchestrate.py. - Boundary markers: The skill utilizes markdown headers (e.g.,
## Task,## Context) to structure prompts inscripts/assembler.py, but it does not provide explicit instructions to the models to ignore commands embedded within the context data. - Capability inventory: The skill can perform parallel network requests to the Anthropic API and execute database operations via a separate memory-management skill.
- Sanitization: No escaping or filtering is applied to the input
contextbefore it is passed to the LLM subagents. - [COMMAND_EXECUTION]: The orchestrator employs
concurrent.futures.ThreadPoolExecutorinscripts/client.pyto handle parallel subagent execution and manage high-volume API requests.
Audit Metadata