cicd-pipeline-qe-orchestrator
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill instructions and workflows focus on quality engineering orchestration and agent coordination. No malicious patterns such as prompt injection, data exfiltration, or obfuscation were found.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external data such as pipeline configurations and test results (e.g., in
evals/cicd-pipeline-qe-orchestrator.yamland the workflow resources). This is an inherent attack surface for indirect prompt injection, but the skill itself does not contain malicious triggers, and the severity is low. - Ingestion points: Processes pipeline configurations, test result JSONs, and incident reports (
qe-production-intelligence). - Boundary markers: Uses structured JSON formats for coordination and results storage in the
aqe/*namespace, which helps in delimiting data. - Capability inventory: Orchestrates agents that perform file analysis, testing, and deployment readiness checks.
- Sanitization: Not explicitly detailed in the provided instructions, but the use of structured schemas (e.g.,
schemas/output.json) provides a layer of validation.
Audit Metadata