task-orchestrator
Warn
Audited by Gen Agent Trust Hub on Feb 27, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill makes extensive use of
tmux send-keysto execute commands in the background, specifically runningcodexwith the--yoloflag. This flag enables autonomous execution of AI-generated commands without user confirmation. - [PERSISTENCE_MECHANISMS]: The skill defines a persistent background operation using
cron action:add. This job is scheduled to run every 15 minutes to monitor orchestration status and automatically restart or 'self-heal' tasks that are detected as stuck or failed. - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: The skill retrieves untrusted data from GitHub using
gh issue list --json number,title,body, which is then used to generate prompts for autonomous execution. - Boundary markers: Absent. The content from issue titles and bodies is interpolated directly into the execution instructions for
codex. - Capability inventory: The orchestrator has the capability to perform git operations (clone, worktree, push), create PRs via
gh, and execute arbitrary commands viatmuxandcodex --yolo. - Sanitization: No sanitization or filtering of the retrieved GitHub issue content is implemented before it is passed to the AI agent.
- [EXTERNAL_DOWNLOADS]: The setup instructions include
git cloneoperations from external repositories to initialize worktrees for task execution.
Audit Metadata