orchestrate
Pass
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Executes shell commands including git for branch management, gh (GitHub CLI) for issue and PR automation, and vercel for deployment diagnostics. It also triggers repository-specific scripts such as scripts/worktree-up.sh and npm run verify.
- [EXTERNAL_DOWNLOADS]: Interacts with official APIs from GitHub, Vercel, and Neon (PostgreSQL) to synchronize project state and manage development environments.
- [DATA_EXFILTRATION]: Accesses the .vercel/repo.json file to extract the teamId necessary for authorized Vercel API requests.
- [PROMPT_INJECTION]: Exhibits a surface for indirect prompt injection (Category 8) by fetching GitHub issue metadata via GraphQL and interpolating it into instructions for sub-agents. Ingestion points: Issue titles and states from the GitHub GraphQL API. Boundary markers: Absent in the package-prompt.md template. Capability inventory: The orchestrator and child agents have significant filesystem and CLI access. Sanitization: No explicit sanitization or filtering of fetched issue content before interpolation.
Audit Metadata