feature-orchestrator
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user input and repository content to generate a detailed implementation prompt for a subsequent session. This creates a potential surface where malicious data in the repository could influence the generated instructions.
- Ingestion points: User conversation and repository files (code, tests, and documentation) are read during the exploration phase.
- Boundary markers: The skill uses a defined template and contract (execution-prompt-contract.md) to structure the generated prompt, providing a clear schema for the output.
- Capability inventory: While the skill itself is read-only, the generated prompt facilitates a Lead agent with capabilities to plan, edit code, and execute tests.
- Sanitization: The instructions require the agent to synthesize findings and research rather than outputting raw data, and it mandates an independent review cycle by a separate agent role (Researcher) to validate the proposed implementation.
- [SAFE]: The skill implements strong process-level security controls, including an explicit prohibition on modifying source code or opening pull requests without direct user authorization. The design enforces a separation between planning and execution sessions, ensuring the initial environment remains read-only.
Audit Metadata