shunk031-orchestrate-herdr-workers
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill establishes a multi-agent hierarchy where an orchestrator agent ingests output (reports) from worker agents as new instructions for its own session.
- Ingestion points: The orchestrator receives reports from sub-agents via the 'herdr agent prompt' command (SKILL.md, Step 9) and actively reads worker transcripts using 'herdr agent read'.
- Boundary markers: Reports are expected to follow a specific status prefix format ('DONE', 'BLOCKED', 'STATUS'). The dispatch template (Step 5) attempts to pin identities to prevent a task from overriding its own worker configuration.
- Capability inventory: The orchestrator agent has broad permissions to spawn and manage Codex agents, modify worktrees, move panes, and facilitate user-facing actions like merging pull requests.
- Sanitization: Step 10 of the SKILL.md mandates that the orchestrator verify worker claims (such as test pass counts and code diffs) against an independent 'source of truth' rather than accepting the report content at face value. This provides a validation layer against deceptive worker output.
- [COMMAND_EXECUTION]: The skill makes extensive use of the 'herdr' CLI to manage the agent environment. It follows defensive coding practices by requiring all prompts to be built in shell variables using quoted heredocs to prevent the shell from expanding or interpreting potentially malicious content within task or report text.
Audit Metadata