utility-pm-workflow-orchestrator
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external plan files (
foundation-prioritized-action-plan) and executes the natural language instructions contained within their "Prompt" blocks. - Ingestion points: Section 7 of plan files, which contain user-generated or previously generated prompts.
- Boundary markers: The skill uses specific delimiters like
#### To executeand**Prompt:**to isolate executable content. - Capability inventory: The orchestrator requires file-writing and Bash execution capabilities to fulfill the tasks of the downstream skills it invokes.
- Sanitization: It implements a "Self-Reference Refusal" to prevent recursive loops but does not sanitize the content of the prompts before execution.
- [DYNAMIC_EXECUTION]: The skill uses a "reference + execute inline" pattern, where it reads the instructions for downstream tasks from other
SKILL.mdfiles at runtime and executes them in the current context. - [COMMAND_EXECUTION]: The orchestration process involves calling other skills that may execute Bash commands on the local system.
- [DATA_EXPOSURE]: The skill reads and processes plan files and writes generated artifacts to the
_pm-skills/plan-orchestrator/directory on the local filesystem.
Audit Metadata