orchestrator-mode

Warn

Audited by Gen Agent Trust Hub on Oct 17, 2026

Risk Level: MEDIUMDYNAMIC_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The script scripts/baseline.mts implements a self-building mechanism that uses bun build to compile its source code into a bundle within a .build directory at runtime before executing it.
  • [COMMAND_EXECUTION]: The orchestration scripts (sweep.mts, probe.mts, ledger.mts, baseline.mts) utilize system command execution via spawnSync and execFile to invoke tools such as git, ps, and lsof for monitoring worktrees and process activity.
  • [EXTERNAL_DOWNLOADS]: The scripts/baseline.mts script executes bun install during its build phase to fetch the diff package from a registry at runtime.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from the repository, including code changes and commit messages, as part of its lead orchestration role.
  • Ingestion points: File contents, git history, and subagent completion signals are ingested through scripts/sweep.mts and scripts/probe.mts as described in Section 2 of SKILL.md.
  • Boundary markers: The instructions mandate human review gates and reference external review skills for verification.
  • Capability inventory: The skill possesses capabilities for file system access, system command execution, and git-based network operations.
  • Sanitization: The skill implements a PII scanning feature that searches for sensitive identifiers using a user-defined 'needle' file before changes are landed on the mainline branch (SKILL.md, Section 6).
Audit Metadata
Risk Level
MEDIUM
Analyzed
Oct 17, 2026, 10:41 PM