agent-graph-orchestration
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest, merge, and act upon artifacts produced by other 'worker agents', which introduces an inherent surface for indirect prompt injection.
- Ingestion points: Untrusted data enters the context through
a2a-artifact.jsonfiles and phase-specific deliverables (e.g.,feature-ticket.json,test-report.json) as described inSKILL.md. - Boundary markers: The skill mandates strict schema validation at every edge using
output_schema_refand requires that phase exit criteria be enforced as policy predicates rather than narrative descriptions. - Capability inventory: The skill utilizes
write_file,execute_command, anda2a_send_taskacross all phases including triage, implementation, and review. - Sanitization: It implements OWASP ASI-aligned checks, such as goal hijack detection (ASI01) and artifact validation (ASI07), to ensure worker outputs do not compromise the supervisor's orchestration logic.
Audit Metadata