workflow-runner
Pass
Audited by Gen Agent Trust Hub on Jul 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to suggest downloading resources from external sources if not found locally. Specifically, it references a GitHub repository (github.com/jnMetaCode/agency-agents-zh.git) and an NPM package (agency-agents-zh).
- [INDIRECT_PROMPT_INJECTION]: The skill processes external YAML workflow files and Markdown role definitions to determine agent behavior. This creates a surface for indirect prompt injection where malicious content in those files could influence the agent's actions.
- Ingestion points: YAML workflow files and Markdown role definition files (e.g.,
{agents_dir}/{role}.md) as described in Steps 1 and 4a. - Boundary markers: The skill uses
{{variable}}templates for task rendering but does not specify explicit safety boundary markers or instructions to ignore embedded commands within the role files. - Capability inventory: The skill utilizes file reading (Read tool), file writing (Write tool for results in
.ao-output/), directory checking (Bash tool), and sub-agent spawning (Agent tool). - Sanitization: No specific sanitization or validation of the content within the YAML or Markdown files is mentioned before processing or role-playing.
- [COMMAND_EXECUTION]: The skill uses the Bash tool to perform directory existence checks (
test -d) to locate role definitions.
Audit Metadata