edge-pipeline-orchestrator
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/orchestrate_edge_pipeline.pyscript usessubprocess.runto call other Python scripts within the research pipeline. The script paths (e.g.,auto_detect_candidates.py,build_hints.py) are hardcoded relative to the skill's root directory, ensuring that execution is limited to intended internal components. - [INDIRECT_PROMPT_INJECTION]: The skill serves as a surface for indirect prompt injection by ingesting and processing data that may contain LLM-generated content or external research data.
- Ingestion points: The orchestrator reads data from user-supplied directories (
--tickets-dir), external data files (--from-ohlcv), and LLM-provided hints (--llm-ideas-file). It also ingestsrevision_instructionsfrom review artifacts generated in earlier pipeline stages. - Boundary markers: The orchestrator does not define explicit boundary markers for the files it processes, relying on the schema-based parsing in downstream scripts.
- Capability inventory: The skill has the capability to execute subprocesses, read from the local filesystem, and write pipeline manifests and artifacts to an output directory.
- Sanitization: Path arguments are resolved using
Path.resolve()to prevent traversal. The feedback loop logic inapply_revisionsuses strict keyword matching (e.g., searching for "add volume filter") to modify data structures, preventing the execution of arbitrary instructions embedded in the review text.
Audit Metadata