iterative-fleet

Pass

Audited by Gen Agent Trust Hub on May 20, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses tmux for process management and isolation of parallel workers. It dynamically generates a local orchestration script (orchestrator.sh) to manage the fleet's lifecycle, which is standard for this type of development tool.\n- [PROMPT_INJECTION]: The skill implements an iterative loop where a reviewer worker's feedback is appended to builder workers' prompts. While this creates a surface for indirect prompt injection, it is a core feature of the skill and uses clear boundary markers. Mandatory Evidence Chain: 1. Ingestion points: orchestrator.sh reads feedback from iterations/<N>/review.md. 2. Boundary markers: build_iter_prompt in orchestrator.sh uses markdown headers (# Reviewer Feedback from Prior Iterations) to delimit feedback. 3. Capability inventory: Workers execute commands via claude, codex, or pi with restricted toolsets defined in lib/tools.sh. 4. Sanitization: Feedback is interpolated into prompts without additional escaping.\n- [EXTERNAL_DOWNLOADS]: Certain worker configurations (e.g., 'research') are documented to use web search and content fetching tools (via the pi-web-access extension or codex config). Tool access is explicitly scoped per worker type in lib/tools.sh.
Audit Metadata
Risk Level
SAFE
Analyzed
May 20, 2026, 04:26 PM
Security Audit — agent-trust-hub — iterative-fleet