multi-agent-orchestration
Pass
Audited by Gen Agent Trust Hub on Jun 19, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted repository files to formulate plans and guide agent behavior. The ingestion of external data combined with the ability to execute shell commands and write to the file system creates an indirect prompt injection surface.
- Ingestion points: Authoritative sources and repository state are read in the 'Heavy Task Run Loop' described in SKILL.md.
- Boundary markers: The 'task-packets.md' reference defines 'source-first' exposure modes to prioritize original materials over agent summaries.
- Capability inventory: Orchestrates subagents which can include shell-callable agents, file system writes to 'docs/multi-agent-orchestration/', and external agent communication.
- Sanitization: Employs a 'Promotion Gate' in 'output-normalization.md' to normalize agent outputs into evidence-backed items before state changes.
- [COMMAND_EXECUTION]: The skill discovers and utilizes 'shell_agent' participants and generic execution tools (shells, scripts, CLIs). It provides explicit logic for 'Shell Agent Run Preflight' and CLI invocation in 'capability-cache.md'.
- [DATA_EXFILTRATION]: The orchestration framework supports sending task content such as prompts, files, and repository context to external, protocol, or editor-based agents. While the skill defines a 'Consent Boundary' in 'capability-cache.md' requiring user permission, the capability to transmit sensitive data exists.
Audit Metadata