Back to skill

Security audit

Agent Orchestrator

Security checks for vulnerabilities and agentic risk

Overview

This skill is purpose-built for autonomous multi-agent delegation, but its broad automatic triggers and limited control gates make it something users should review carefully before installing.

Install only if you intentionally want macro-task delegation through autonomous sub-agents. Before use, review the planned agents, their input files, tool access, workspace paths, and outputs; avoid using it on sensitive repositories or private data unless you add explicit confirmation and scoping controls.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · references/communication-protocol.md (reported line 72)May include surrounding context.

md
# Task: {TASK_NAME}

## Objective
{Clear statement of what needs to be accomplished}

## Context
{Background information relevant to the task}

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The description also fails to warn that the skill delegates work to autonomous sub-agents that may act on generated instructions and process copied input files. In this skill's context, that omission is especially dangerous because the orchestrator dynamically generates sub-agent SKILL.md files and instructs agents to 'follow its instructions', creating a high-risk delegation chain where users may not appreciate the scope of autonomous actions being launched.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The description also fails to warn that the skill delegates work to autonomous sub-agents that may act on generated instructions and process copied input files. In this skill's context, that omission is especially dangerous because the orchestrator dynamically generates sub-agent SKILL.md files and instructs agents to 'follow its instructions', creating a high-risk delegation chain where users may not appreciate the scope of autonomous actions being launched.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The mandatory trigger list includes very broad phrases such as 'orchestrate', 'delegate tasks', and 'task breakdown' that are likely to match ordinary user requests and auto-activate this skill unexpectedly. Because this skill can spawn autonomous sub-agents and generate files, overbroad activation increases the chance of unrequested delegation, workspace creation, and task execution beyond user intent.

Content

No source excerpt is available for this finding.