Skills orchestrator-agent
📦
orchestrator-agent
Content revision r1 Medium Risk ⚙️ External commands
Coordinate Unite-Hub Agent Workflows
Complex Unite-Hub work can lose context across email, content, audit, and health checks. This skill validates blockers first, routes work to specialist agents, and reports progress clearly.
Supports: Claude Codex Code(CC)
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "orchestrator-agent" from https://skillstore.io/skills/cleanexpo-orchestrator-agent.md and its manifest at https://skillstore.io/api/skills/cleanexpo-orchestrator-agent/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "orchestrator-agent". Run the full email and content workflow for warm leads.
Expected outcome:
- Workflow started after blocker validation passed.
- Email processing completed with processed, updated, and skipped counts.
- Draft content was generated for qualified leads and queued for review.
- Recommended next action is to review pending drafts before scheduling sends.
Using "orchestrator-agent". Run system audit before content approval.
Expected outcome:
- Health status summarizes data integrity, recent audit activity, database checks, and agent performance.
- Critical blockers are listed first with root cause and estimated resolution time.
- The report separates safe next steps from actions that should wait.
Using "orchestrator-agent". Approve all content for two named contacts.
Expected outcome:
- The orchestrator finds matching drafts and validates contact readiness.
- It records approval decisions, updates follow-up timing, and produces an audit-friendly summary.
- Items that fail validation remain in draft status with reasons.
Security Audit
Medium Riskv8 • 7/5/2026 Open versioned report
Most static findings are false positives caused by Markdown code fences being classified as Ruby or shell backticks. No prompt injection or malicious exfiltration intent was found in SKILL.md. Semantic review found medium risks around unredacted error context logging and generic system-user approval attribution.
1
Files scanned
398
Lines analyzed
0
Review items
0
False positives ignored
Confirmed security concerns (2)
Medium
Sensitive Error Context Logging
The error logging template includes error messages, stack traces, and context in audit events. Without redaction, this can expose contact details, email content, API errors, or internal paths.
Lines 293-300 explicitly include stack_trace and context in audit details. The exact stored data depends on implementation, so confidence is high but not absolute.
Medium
Generic System User Approval Attribution
The approval workflow uses userId=system when approving content drafts. If implemented directly, this can weaken user accountability and authorization checks.
Line 146 explicitly names a system user for approvals, and this file does not describe permission checks. The risk depends on the backing application implementation.
Risk Factors
⚙️ External commands (53)
SKILL.md:22-41 SKILL.md:41-62 SKILL.md:62-64 SKILL.md:64-67 SKILL.md:67-71 SKILL.md:71-74 SKILL.md:74-80 SKILL.md:80-83 SKILL.md:83-88 SKILL.md:88-91 SKILL.md:91-95 SKILL.md:95-98 SKILL.md:98-103 SKILL.md:103-106 SKILL.md:106-113 SKILL.md:113-116 SKILL.md:116-118 SKILL.md:118-128 SKILL.md:128-133 SKILL.md:133-136 SKILL.md:136-141 SKILL.md:141-144 SKILL.md:144-147 SKILL.md:147-150 SKILL.md:150-154 SKILL.md:154-157 SKILL.md:157-160 SKILL.md:160-163 SKILL.md:163-169 SKILL.md:169-179 SKILL.md:179-185 SKILL.md:185-188 SKILL.md:188-194 SKILL.md:194-197 SKILL.md:197-203 SKILL.md:203-206 SKILL.md:206-212 SKILL.md:212-215 SKILL.md:215-238 SKILL.md:238-243 SKILL.md:243-266 SKILL.md:266-294 SKILL.md:294-301 SKILL.md:301-306 SKILL.md:306-316 SKILL.md:316-319 SKILL.md:319-327 SKILL.md:327-330 SKILL.md:330-339 SKILL.md:339-342 SKILL.md:342-351 SKILL.md:351-356 SKILL.md:356-387
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/cleanexpo-orchestrator-agent/audits/8?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/cleanexpo-orchestrator-agent?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/cleanexpo-orchestrator-agent?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/cleanexpo-orchestrator-agent/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/cleanexpo-orchestrator-agent.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
CleanExpo. (2026). orchestrator-agent security audit report (audit version 8) [Author version unspecified]. Skillstore. https://skillstore.io/skills/cleanexpo-orchestrator-agent/audits/8BibTeX citation
@techreport{cleanexpo-cleanexpo-orchestrator-agent-2026,
author = {CleanExpo},
title = {orchestrator-agent security audit report (audit version 8)},
institution = {Skillstore},
year = {2026},
number = {8},
url = {https://skillstore.io/skills/cleanexpo-orchestrator-agent/audits/8},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "orchestrator-agent security audit report (audit version 8)"
version: "unspecified"
type: report
authors:
- name: "CleanExpo"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/cleanexpo-orchestrator-agent/audits/8"
identifiers:
- type: other
value: "skillstore:cleanexpo-orchestrator-agent:audit:8"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: High 55
Architecture
85
Maintainability
87
Content
71
Community
83
Spec Compliance
What You Can Build
Run Email-To-Content Pipelines
Coordinate email processing, lead scoring, content generation, and completion reporting in one workflow.
Check Unite-Hub Health
Review data integrity, recent audit activity, database status, and agent performance before starting work.
Manage Content Approvals
Fetch draft content, validate contact readiness, approve selected items, and prepare scheduling reports.
Try These Prompts
Run A Basic Status Check
Check the current Unite-Hub workflow status and summarize active blockers, pending content, and next recommended actions.
Process Warm Leads
Process new emails, identify warm leads with high AI scores, generate draft follow-up content, and report the results.
Approve Selected Drafts
Find the top five draft content items, verify each contact is ready, ask for approval, then prepare a scheduling summary.
Audit And Recover A Failing Pipeline
Run a full system audit, classify each error by severity, identify the root cause, and propose a recovery plan with owner and timeline.
Best Practices
- Run blocker validation before starting multi-agent workflows.
- Confirm content approvals with an authorized user before changing draft status.
- Review audit and memory outputs after each long-running pipeline.
Avoid
- Do not execute workflow commands without checking system health first.
- Do not store raw stack traces, secrets, or email content in audit logs.
- Do not approve or schedule generated content without contact validation.
Frequently Asked Questions
What does this skill coordinate?
It coordinates Unite-Hub email processing, content generation, approval, audit, memory, and health-check workflows.
Does it include executable code?
No. The skill provides workflow instructions and report templates, not runnable scripts or source code.
Which tools can use it?
The report lists support for Claude, Codex, and Claude Code.
Can it approve content automatically?
It describes approval steps, but production use should require authorized user confirmation and full audit attribution.
How does it handle failures?
It classifies errors as recoverable, significant, or critical and describes matching retry, alert, or halt actions.
What systems are required?
It expects Unite-Hub specialist agents, Convex database access, audit logging, and persistent memory support.