triage-orchestrator
Warn
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions provide a shell command template (
python -c "..." "<candidate title + claim>") that interpolates data from parsed reports directly into a command line. If the agent does not properly escape characters like backticks, semicolons, or command substitution markers in the title or claim fields, it allows for arbitrary shell command execution. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and parse "scout reports" which are external, untrusted data sources. The analysis of this data involves agent "judgment" for scoring and classification without any boundary markers or instructions to ignore embedded commands. This creates a surface where a malicious report could influence the agent's decision-making process or trigger unintended tool use.
- [DATA_EXFILTRATION]: The skill uses the
hermes sendtool to transmit local proposal files to an external Telegram endpoint. While this is part of the intended human-in-the-loop notification system, the ability to send local files over the network combined with the ingestion of untrusted external reports presents a risk of sensitive data exfiltration if the agent's logic is manipulated.
Audit Metadata