orchestrate
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill acts as an orchestration engine that ingests data from project files and subagent responses, which are then interpolated into future prompts to drive the agent's behavior.
- Ingestion points: Data enters the system from project-specific state files in
.omx/state/omxr/(handled in01-state-read.md) and from the text output of dispatched subagents (handled in02-dispatch.md). - Boundary markers: The
02-dispatch.mdprimitive uses---separators and markdown headers to distinguish between the agent's persona instructions, the specific task brief, and the provided state context. - Capability inventory: The framework is capable of executing local shell commands for repository management, dispatching further subagents, and performing filesystem read/write operations.
- Sanitization: The skill logic does not demonstrate explicit sanitization or escaping of the interpolated
state_sliceortask_briefcontent, relying on the structural delimiters of the prompt assembly. - [COMMAND_EXECUTION]: The
04-loop.mdprimitive includes an optional hook to automate local version control by executinggit add -Aandgit commitvia the system shell. These commands are used for project state tracking and are constructed using internal identifiers like the engine name and a generated UUID.
Audit Metadata