agent-orchestrator-parallel-coding
Fail
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPERSISTENCEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The installation instructions for contributors involve cloning a repository from GitHub and executing a setup script (
bash scripts/setup.sh). This constitutes execution of unverified remote code from an external source. - [EXTERNAL_DOWNLOADS]: The skill requires the installation of global NPM packages (
@aoagents/ao) and cloning from external repositories (ComposioHQ/agent-orchestrator). - [PERSISTENCE]: The skill provides instructions to modify the user's Zsh shell configuration (
~/.zshrc) to enable completions, allowing changes to persist across shell sessions. - [INDIRECT_PROMPT_INJECTION]: The reaction patterns ingest untrusted data from CI logs and PR comments into agent prompts without explicit sanitization.
- Ingestion points: CI failure logs (
{{errors}}) and PR review comments ({{comments}}) inSKILL.md. - Boundary markers: Absent in the YAML templates.
- Capability inventory: The skill executes agents with broad capabilities including filesystem writes, git operations, and network notifications.
- Sanitization: No evidence of sanitization for external content before processing.
- [DYNAMIC_EXECUTION]: The skill is designed to spawn and manage AI agents (
claude-code,aider,cursor) that autonomously generate and execute code in isolated git worktrees. This represents dynamic execution of AI-generated content at runtime. - [COMMAND_EXECUTION]: The skill relies on system commands (
git,tmux,npm) and provides CLI tools for session management that interact directly with the host shell.
Recommendations
- AI detected serious security threats
Audit Metadata