workflow-from-chats
Pass
Audited by Gen Agent Trust Hub on Aug 22, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill performs workflow mining by reading transcript data from external sources (Codex, Pi, and Claude Code) to create or edit skills and rules. This exposes the agent to indirect prompt injection if those transcripts contain malicious instructions.
- Ingestion points: Transcript and metadata stores for Codex, Pi, and Claude Code chats as described in SKILL.md.
- Boundary markers: The skill does not define specific markers or delimiters to isolate untrusted transcript data from the agent's internal reasoning.
- Capability inventory: The skill has the authority to generate new artifacts (skills, rules, docs) and modify existing skills, allowing potentially poisoned data to influence the system's long-term behavior.
- Sanitization: The instructions lack specific requirements for sanitizing or validating transcript content against prompt injection patterns before artifact generation.
Audit Metadata