control-session-orchestrator
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill implements an orchestration pattern where a central 'control session' processes untrusted output from 'worker sessions'.
- Ingestion points: Worker reports are ingested in
SKILL.md(Step 5 and Step 6), specifically targeting fenced JSON blocks. - Boundary markers: The skill enforces strict boundary markers using fenced code blocks tagged with
json control-resultinSKILL.md(Machine-checkable contracts section). - Capability inventory: The orchestrator has the capability to spawn new persistent sessions (Step 4), steer existing sessions, and execute verification commands (Step 8).
- Sanitization: The skill defines a 'result-gate' in
SKILL.md(Step 6) that mandates strict JSON parsing, schema validation, and enum checks (complete|blocked|needs-decision|failed). It also implements a retry cap (2 retries) before escalating to a human user, which limits automated exploitation attempts. - [COMMAND_EXECUTION]: The skill facilitates the execution of arbitrary verification commands.
- Evidence:
SKILL.md(Contract:verification.command, Step 8: 'Run or delegate the agreed verification gate'). While these are intended for test execution (e.g.,pnpm test), the workflow allows worker sessions to influence which commands the control session might execute or delegate.
Audit Metadata