edge-pipeline-orchestrator

Pass

Audited by Gen Agent Trust Hub on Oct 12, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The scripts/orchestrate_edge_pipeline.py script uses subprocess.run to call other Python scripts within the research pipeline. The script paths (e.g., auto_detect_candidates.py, build_hints.py) are hardcoded relative to the skill's root directory, ensuring that execution is limited to intended internal components.
  • [INDIRECT_PROMPT_INJECTION]: The skill serves as a surface for indirect prompt injection by ingesting and processing data that may contain LLM-generated content or external research data.
  • Ingestion points: The orchestrator reads data from user-supplied directories (--tickets-dir), external data files (--from-ohlcv), and LLM-provided hints (--llm-ideas-file). It also ingests revision_instructions from review artifacts generated in earlier pipeline stages.
  • Boundary markers: The orchestrator does not define explicit boundary markers for the files it processes, relying on the schema-based parsing in downstream scripts.
  • Capability inventory: The skill has the capability to execute subprocesses, read from the local filesystem, and write pipeline manifests and artifacts to an output directory.
  • Sanitization: Path arguments are resolved using Path.resolve() to prevent traversal. The feedback loop logic in apply_revisions uses strict keyword matching (e.g., searching for "add volume filter") to modify data structures, preventing the execution of arbitrary instructions embedded in the review text.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 12, 2026, 05:10 AM