signal-lab-orchestrator
Pass
Audited by Gen Agent Trust Hub on Jun 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: Indirect Prompt Injection Surface\n
- Ingestion points: The skill reads and processes implementation requirements from the
prds/directory, specifically files identified byprdPath.\n - Boundary markers: The prompt templates in
COORDINATION.mdand logic inSKILL.mdlack delimiters or explicit instructions for subagents to disregard instructions embedded within the PRD content.\n - Capability inventory: The system leverages powerful capabilities, including the
shellsubagent role for command execution and theimplementerrole for modifying codebase files.\n - Sanitization: There is no evidence of sanitization or safety-filtering applied to the PRD content before it is used to generate tasks and plan executions.\n- [COMMAND_EXECUTION]: Subagent Command Capabilities\n
- The orchestrator specifically defines a
shellsubagent role for tasks such as "running commands, docker, tests". While intrinsic to the skill's purpose as an automated implementer, this capability serves as an execution vector if the agent is manipulated by untrusted data in the PRDs.
Audit Metadata