kero-orchestrate

Pass

Audited by Gen Agent Trust Hub on Oct 5, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONMETADATA_POISONING
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides templates for executing various command-line tools to delegate tasks to sub-agents or external services, including cursor-agent, codex, grok, gemini, and higgsfield. It also suggests loading orchestration skills via orca skills get orchestration.\n- [INDIRECT_PROMPT_INJECTION]: The skill defines a multi-agent orchestration pattern where a coordinator processes reports from workers, creating a surface for indirect prompt injection.\n
  • Ingestion points: The coordinator receives reports from workers that include status updates and paths to artifacts (documented in SKILL.md under 'The brief').\n
  • Boundary markers: The skill specifies that every brief is self-contained and the worker has no access to the main conversation context.\n
  • Capability inventory: The skill possesses the capability to execute shell commands, write to the filesystem (via workers), and call various external AI APIs.\n
  • Sanitization: The skill explicitly instructs the agent to not trust worker summaries, review diffs in fresh contexts, and run acceptance checks before merging work.\n- [METADATA_POISONING]: The skill instructions and delegation tables reference non-existent or futuristic AI models such as 'GPT-6 Astra' and 'GPT-5.x'. While likely intended as placeholders for future capabilities, these entries are technically deceptive regarding the current environment's supported tools.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 5, 2026, 09:54 PM