orchestrator
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary logic involves decomposing a user-provided task into subtasks for specialized agents, creating a significant injection surface. \n
- Ingestion points: The
user_taskvariable inscripts/run_orchestrator.py(line 373) receives arbitrary string input from the user via command-line arguments. \n - Boundary markers: Subtask instructions are constructed by interpolating the raw user input directly into agent prompts (e.g., lines 192, 203) without protective delimiters or explicit instructions to ignore embedded commands. \n
- Capability inventory: The orchestrator agent is granted full project file system read access, the
bashtool, and the ability to invoke external MCP skills via theCodexMCPBridge. \n - Sanitization: No validation, escaping, or filtering is performed on the user-supplied task description before it is passed to sub-agents. \n- [COMMAND_EXECUTION]: The agent configuration in
agents/openai.yamlenables thebashtool, allowing the agent to execute shell commands as part of the implementation and build phases of its workflows.
Audit Metadata