orchestrate
Warn
Audited by Gen Agent Trust Hub on Jul 17, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script executes external AI agent CLIs (e.g., claude, cursor-agent, codex, gemini) using high-privilege flags like '--dangerously-skip-permissions', '--dangerously-bypass-approvals-and-sandbox', or '--yolo'. This allows background agents to run shell commands and modify files without per-action user approval.\n- [REMOTE_CODE_EXECUTION]: The 'load_profile' function in 'orchestrate.sh' dynamically sources shell script fragments ('. "$f"') from '$ORCH_HOME/profiles/'. This mechanism for loading agent profiles allows for the execution of arbitrary shell code if malicious files are placed in that directory.\n- [COMMAND_EXECUTION]: The 'spawn' subcommand accepts a '--cmd' argument that allows the execution of arbitrary shell commands within a tmux or cmux session.\n- [PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection (Category 8) because its state classification logic relies on screen-scraping terminal output from sub-agents.\n
- Ingestion points: The 'mux_capture' function in 'orchestrate.sh' reads the TUI output of background worker sessions.\n
- Boundary markers: The captured content is processed directly by regular expressions without boundary markers to distinguish agent-generated state markers from potentially malicious data being processed or displayed by the agent.\n
- Capability inventory: The orchestrator can send arbitrary keys and text to sessions ('mux_send_key', 'mux_send_text'), terminate sessions ('mux_kill'), and read session history ('logs').\n
- Sanitization: The script uses 'strip_ansi' to remove ANSI escape sequences and control characters before performing regex matches in the 'classify()' function.
Audit Metadata