Agent Orchestrator 0.1.0

• Analyzed: May 14, 2026, 4:01 AM
• Findings: 1
• Version: 1.0.0
• Hash: c68f6d655b6f6d7ea4b4fb49dd348169cebd51c6095f324f147a6c2fc6ec31d5
• Source: palm
• External report: View on VirusTotal

Findings (1)

This skill bundle describes an agent orchestration system that dynamically generates `SKILL.md` files for sub-agents, as detailed in `SKILL.md`. Several sub-agent templates in `references/sub-agent-templates.md` explicitly list `Bash: Execute commands` or similar shell execution capabilities. This architecture presents a significant prompt injection vulnerability: a malicious user could potentially craft input to the orchestrator that causes it to inject harmful commands into a sub-agent's dynamically generated `SKILL.md`, leading to arbitrary command execution. While no direct malicious intent (e.g., data exfiltration, persistence) is found within the provided files, the inherent design creates a high-risk attack surface.