Multi Agent Orchestrator

• Outcome: Review
• Latest audit: Aug 24, 2026 · 12:41 PM UTC
• Version: 5.3.0

Overview

This workflow-orchestration skill appears useful and not malicious, but it has enough powerful local execution, persistence, broad activation, and under-scoped safety controls to require Review before installation.

Install only if you want a local workflow-orchestration skill and are comfortable with it creating and modifying pipeline state, report, history, and snapshot files. Keep state paths inside a dedicated workspace, do not store secrets or raw credentials in node outputs/errors, avoid untrusted templates or dependency names, and review any template that performs approvals, video analysis, external-service use, or broad file handoffs before running it.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (21)

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution

Content

# 尝试 import（如果 skill_id 可映射为 Python 模块）
    try:
        __import__(skill_id.replace('-', '_'))
        return True, '已安装（Python 模块可导入）'
    except ImportError:
        pass

• Confidence: 88% confidence
• Finding: The template metadata controls `skill_id`, and this value is transformed and passed directly into `__import__()`. Importing a module executes its top-level code, so a crafted template or dependency entry can trigger arbitrary code execution if an attacker can influence template contents or place a malicious module earlier on `sys.path`. In this orchestration context, dependency checks are expected to be passive, which makes active code execution during detection more dangerous and surprising.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill advertises and operationalizes powerful capabilities including shell execution, local file read/write, environment inspection, and network access, yet it does not declare a permissions model or user-consent boundary. In an orchestration skill that encourages AI-generated pipelines and command execution, this gap makes it easier for the agent to perform sensitive actions without clear authorization, increasing the risk of unintended file access, command execution, or outbound requests.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The documented security model says function calls are forbidden, but the implementation actually permits many builtin-like functions plus regex evaluation. In a workflow orchestrator that evaluates user-authored conditions, this mismatch can cause unsafe deployment assumptions and can also expose the engine to denial-of-service via expensive regex patterns or unexpectedly powerful expressions that operators believed were disallowed.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The code claims sub-pipeline isolation with only explicitly mapped outputs exposed, but it also stores sub_state_path in the parent node's output_data. That leaks a filesystem path to the child workflow state, which may allow other components or prompts in the parent context to discover, read, or tamper with the supposedly isolated child state if they have file access. In an orchestration skill with shared state and multi-agent execution, this weakens a trust boundary and can expose sensitive intermediate data beyond the intended output mapping.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The script prepends its own directory to sys.path before importing sibling modules, so executing this file from a writable or attacker-controlled installation directory can cause Python to load malicious local modules such as dag_validator.py or state_store.py. This contradicts the 'read-only' safety framing of commands like plan, because code execution happens at import time before command semantics matter.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The file exposes a version update check capability that likely performs outbound network access, but the skill metadata does not disclose this behavior. Undeclared network communication is a security-relevant transparency issue because users may run the skill in restricted or sensitive environments and not expect external connections.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The code claims to prevent path traversal, but `_validate_path()` only normalizes the user-supplied path and checks that it exists. It does not restrict the file to an approved base directory, so an attacker or untrusted caller can register arbitrary existing JSON files anywhere on the filesystem and persist their absolute paths into the registry.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The security note claims path normalization and path-traversal protection, but this file directly trusts caller-controlled state_path-derived locations when creating checkpoint directories and when resolving snapshot paths through helper functions. In an orchestration system that shares state across agents, misleading security claims can cause operators and downstream code to rely on protections that do not actually exist, enabling unintended file access or writes if untrusted paths are supplied.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: `validate_path()` only normalizes a supplied path and converts it to an absolute path; it does not restrict the result to a trusted workspace directory. As a result, any caller that can influence `state_path` can cause the program to read from or write to arbitrary filesystem locations while the code and docs misleadingly claim traversal protection.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The module-level security note asserts that all file paths are checked to prevent path traversal, but the implementation allows arbitrary absolute paths for state files and then derives sibling files like `.execution_history.json` in that directory. In a multi-agent orchestration skill that persists shared state, this can let untrusted workflow configuration redirect reads/writes outside the intended project area and overwrite or disclose unrelated files accessible to the process.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The trigger phrases around this section are broad enough that ordinary user requests such as asking for reports, costs, retries, or visualization may unintentionally activate the skill. Because this skill can lead to orchestration actions, file writes, shell commands, and state changes, accidental activation expands the chance of the agent taking actions the user did not explicitly intend under this skill.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: This section also uses highly generic triggers such as error recovery, retry, fallback, and impact analysis, which are common phrases in normal conversation. In the context of a workflow engine with operational commands, these ambiguous triggers can cause unintended routing into a powerful skill and result in accidental execution or modification of pipeline state.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The guidance recommends offloading large node outputs into standalone files and having downstream agents read them, but it omits basic controls for sensitive data classification, file permissions, retention, and path trust. In a multi-agent pipeline with shared state and file-based handoff, this can expose confidential data or enable unintended access to stale or attacker-influenced files.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The cross-pipeline sharing advice encourages using the filesystem for intermediate result exchange without warning about tenant isolation, authenticity, or accidental reuse of wrong files. In this orchestration context, that can cause data leakage between workflows or tampering with shared artifacts that downstream agents trust as legitimate inputs.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The protocol explicitly instructs agents to persist node outputs and error messages into `pipeline_state.json`, which can easily capture sensitive user data, system prompts, secrets, tokens, file paths, or stack traces. Although the document briefly says not to store API keys or passwords, it does not define storage protections, retention limits, redaction requirements, or access controls, so the shared state file becomes a durable aggregation point for sensitive data across the whole multi-agent pipeline.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The gantt command generates HTML output derived from workflow state, yet unlike report/visualize it does not present a user-facing warning that outputs may contain sensitive node data. In an orchestration skill that aggregates multi-agent outputs and history, this omission can lead to accidental disclosure through saved artifacts or sharing of generated HTML files.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The update check command likely triggers network access, but neither its docstring nor user-facing help text discloses that it will contact an external service. Hidden network activity is dangerous in controlled environments because it can violate policy, leak metadata, or surprise users who assume local-only behavior.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The template explicitly processes local or online videos and performs OCR plus person/object detection, which can expose personal, biometric, or otherwise sensitive content without any user-facing privacy notice or consent checkpoint. In a multi-agent batch pipeline, this is more dangerous because users may submit large volumes of videos and have them analyzed automatically, increasing the chance of unnoticed collection or processing of sensitive data.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The manifest declares an external video-understanding dependency but does not warn that video content, keyframes, OCR text, or derived metadata may be transmitted to a third-party service. This creates a data-sharing and privacy risk, especially in a batch-analysis workflow where many files may be processed and users may assume analysis is local unless explicitly told otherwise.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

"name": "金额审核",
      "type": "condition",
      "condition": "nodes.invoice_step.output_data.amount <= 5000",
      "on_true": ["auto_approve"],
      "on_false": ["manager_review"],
      "depends_on": ["invoice_step"]
    },

• Confidence: 84% confidence
• Finding: The condition routes expenses of 5000 or less directly to an automatic approval path based only on extracted invoice amount. In a multi-agent orchestration context, relying on a single parsed field from a child pipeline without additional fraud checks, confidence thresholds, or human review can enable unauthorized reimbursement or approval of manipulated inputs.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

"depends_on": ["invoice_step"]
    },
    {
      "id": "auto_approve",
      "name": "自动审批",
      "role": "金额在限额内，自动审批通过",
      "type": "task",

• Confidence: 86% confidence
• Finding: This node explicitly performs automatic approval, which is a security-relevant business action with no visible compensating controls in the template. Because the broader skill supports cross-skill state sharing and reusable pipelines, an unsafe approval node can propagate trust in unverified outputs and increase the chance of fraudulent or erroneous approvals at scale.

Static analysis

No suspicious patterns detected.