swarm
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill establishes an orchestration workflow that fans out tasks to multiple worker agents, creating a surface for indirect instructions.
- Ingestion points: The skill ingests task briefs from user input and role configurations from
kickoff.yaml(SKILL.md). - Boundary markers: The design explicitly implements a security boundary, stating that 'Child agents get only the brief, never the parent's context' (SKILL.md, Phase B).
- Capability inventory: The skill uses
delegate_taskfor asynchronous agent spawning,t3_thread_launchfor workspace isolation, andtask_statusfor lifecycle management (SKILL.md). - Sanitization: Risk is mitigated through strict context scoping, ensuring that any malicious instructions in a single worker's brief cannot access the parent agent's state or credentials.
- [COMMAND_EXECUTION]: The skill references a local setup utility to manage its configuration environment.
- Evidence: The instructions include a fallback to run
kickoff-setupif the required roles configuration file (kickoff.yaml) is missing (SKILL.md, Phase A).
Audit Metadata