task-orchestrator

Warn

Audited by Gen Agent Trust Hub on Feb 27, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill makes extensive use of tmux send-keys to execute commands in the background, specifically running codex with the --yolo flag. This flag enables autonomous execution of AI-generated commands without user confirmation.
  • [PERSISTENCE_MECHANISMS]: The skill defines a persistent background operation using cron action:add. This job is scheduled to run every 15 minutes to monitor orchestration status and automatically restart or 'self-heal' tasks that are detected as stuck or failed.
  • [INDIRECT_PROMPT_INJECTION]:
  • Ingestion points: The skill retrieves untrusted data from GitHub using gh issue list --json number,title,body, which is then used to generate prompts for autonomous execution.
  • Boundary markers: Absent. The content from issue titles and bodies is interpolated directly into the execution instructions for codex.
  • Capability inventory: The orchestrator has the capability to perform git operations (clone, worktree, push), create PRs via gh, and execute arbitrary commands via tmux and codex --yolo.
  • Sanitization: No sanitization or filtering of the retrieved GitHub issue content is implemented before it is passed to the AI agent.
  • [EXTERNAL_DOWNLOADS]: The setup instructions include git clone operations from external repositories to initialize worktrees for task execution.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Feb 27, 2026, 05:06 PM