kero-orchestrate
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONMETADATA_POISONING
Full Analysis
- [COMMAND_EXECUTION]: The skill provides templates for executing various command-line tools to delegate tasks to sub-agents or external services, including
cursor-agent,codex,grok,gemini, andhiggsfield. It also suggests loading orchestration skills viaorca skills get orchestration.\n- [INDIRECT_PROMPT_INJECTION]: The skill defines a multi-agent orchestration pattern where a coordinator processes reports from workers, creating a surface for indirect prompt injection.\n - Ingestion points: The coordinator receives reports from workers that include status updates and paths to artifacts (documented in SKILL.md under 'The brief').\n
- Boundary markers: The skill specifies that every brief is self-contained and the worker has no access to the main conversation context.\n
- Capability inventory: The skill possesses the capability to execute shell commands, write to the filesystem (via workers), and call various external AI APIs.\n
- Sanitization: The skill explicitly instructs the agent to not trust worker summaries, review diffs in fresh contexts, and run acceptance checks before merging work.\n- [METADATA_POISONING]: The skill instructions and delegation tables reference non-existent or futuristic AI models such as 'GPT-6 Astra' and 'GPT-5.x'. While likely intended as placeholders for future capabilities, these entries are technically deceptive regarding the current environment's supported tools.
Audit Metadata