subagent-orchestrator
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill acts as an orchestrator that translates complex user task descriptions into instruction packets for sub-agents. This design pattern creates a surface for indirect prompt injection, where malicious instructions within a task or an agent's output could influence downstream operations.
- Ingestion points: User-defined goals and project requirements are processed to generate Mission Briefs and Agent Context Packets in SKILL.md.
- Boundary markers: The skill uses "MISSION BRIEF" and "AGENT CONTEXT PACKET" headers to structure content, but lacks specific instructions to ignore embedded adversarial commands.
- Capability inventory: The coordination logic facilitates file system changes and potential terminal command execution through its sub-agent roles.
- Sanitization: No input validation or content filtering mechanisms were identified for content interpolated into instructions.
- Multi-step chains: The execution flow in Phase 4 uses the output of Round 1 agents as context for Round 2 agents, which can propagate malicious instructions through the sequence.
Audit Metadata