teams-orchestrate
Warn
Audited by Gen Agent Trust Hub on Mar 30, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
jqand shell redirection to modify the agent's internal configuration file (.claude/settings.local.json). This alters the execution environment by enabling experimental features automatically without explicit user intervention beyond the initial skill invocation. - [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface (Category 8) by ingesting data from
tasks.mdandspec.mdto drive its orchestration logic. - Ingestion points: The skill reads
tasks.mdto analyze dependencies andspec.mdto provide context for sub-agents. - Boundary markers: There are no explicit delimiters or instructions to ignore embedded commands within the ingested files.
- Capability inventory: The skill possesses the ability to execute shell commands (
jq), spawn multiple sub-agents, and perform git operations (worktree management). - Sanitization: No sanitization or validation is performed on the content of the markdown files before they are parsed or interpolated into sub-agent prompts.
Audit Metadata