orchestrate

Pass

Audited by Gen Agent Trust Hub on Sep 9, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill acts as an orchestration engine that ingests data from project files and subagent responses, which are then interpolated into future prompts to drive the agent's behavior.
  • Ingestion points: Data enters the system from project-specific state files in .omx/state/omxr/ (handled in 01-state-read.md) and from the text output of dispatched subagents (handled in 02-dispatch.md).
  • Boundary markers: The 02-dispatch.md primitive uses --- separators and markdown headers to distinguish between the agent's persona instructions, the specific task brief, and the provided state context.
  • Capability inventory: The framework is capable of executing local shell commands for repository management, dispatching further subagents, and performing filesystem read/write operations.
  • Sanitization: The skill logic does not demonstrate explicit sanitization or escaping of the interpolated state_slice or task_brief content, relying on the structural delimiters of the prompt assembly.
  • [COMMAND_EXECUTION]: The 04-loop.md primitive includes an optional hook to automate local version control by executing git add -A and git commit via the system shell. These commands are used for project state tracking and are constructed using internal identifiers like the engine name and a generated UUID.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 9, 2026, 09:21 AM
Security Audit — agent-trust-hub — orchestrate