team-orchestration

Warn

Audited by Gen Agent Trust Hub on Apr 5, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes the Agent tool with the mode: "bypassPermissions" parameter. This configuration allows sub-agents to operate autonomously, executing shell commands and performing file operations (such as creating git worktrees via EnterWorktree) without requiring manual user approval for each action.- [PROMPT_INJECTION]: The orchestration workflow involves processing data from external sources, specifically teammate messages via SendMessage and task definitions via TaskCreate. Ingestion points for untrusted data include the content of messages and the description of tasks in SKILL.md. There are no explicit boundary markers or sanitization procedures defined to distinguish between orchestration instructions and potentially malicious content embedded in teammate communications. The capabilities available to this system include dynamic agent spawning and multi-agent coordination.- [COMMAND_EXECUTION]: The skill uses ToolSearch to dynamically load a suite of tools (SendMessage, TaskCreate, TaskUpdate, TaskList, TaskGet, EnterWorktree) into the execution environment at runtime, as documented in the Prerequisites section of SKILL.md.- [COMMAND_EXECUTION]: The skill architecture involves the dynamic generation and execution of agent prompts for teammates. This creates a complex execution environment where the 'lead' agent defines the operational instructions for multiple sub-agents, increasing the risk surface for automated actions.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Apr 5, 2026, 07:45 PM