control-session-orchestrator
Pass
Audited by Gen Agent Trust Hub on Jun 12, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill's architecture for multi-agent orchestration naturally ingests data from external worker sessions, creating a surface for indirect prompt injection. However, the skill implements several robust defensive measures:
- Ingestion points: Data enters the control session via worker reports from independent sessions (documented in SKILL.md, Step 5).
- Boundary markers: The skill mandates the use of a fenced
control-resultJSON block, which acts as a machine-parseable contract. The instructions explicitly tell the agent to "never read the surrounding prose" when updating state. - Capability inventory: The control session has the capability to dispatch new workers, manage a central manifest file, and run verification commands (e.g.,
pnpm test). - Sanitization: Step 6 (Result-gate) requires the agent to parse the JSON strictly, reject malformed blocks, and verify that the status is consistent with the evidence provided before accepting work.
- [COMMAND_EXECUTION]: The skill mentions executing verification commands like
pnpm test. These are described as local development tools used within the project's context for testing and are not associated with remote code execution or unauthorized access. - [DATA_EXFILTRATION]: The skill includes an explicit safety rule prohibiting workers from sharing secrets or sensitive data across sessions, reducing the risk of accidental or intentional data exposure during orchestration.
Audit Metadata