workflow-monitor
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to capture and process external data from workflow executions, creating a vulnerability to indirect prompt injection.\n
- Ingestion points: Command outputs, error logs, and execution events are captured in
modules/detection-patterns.md(e.g.,command_output=$(some_command 2>&1)).\n - Boundary markers: The issue templates in
modules/issue-templates.mddo not include explicit delimiters or warnings to the agent to treat the workflow data as untrusted.\n - Capability inventory: The skill utilizes the
gh CLIfor searching and creating GitHub issues and performs various file read operations.\n - Sanitization: There is no evidence of sanitization, escaping, or filtering for external content before it is used to generate reports or analysis.\n- [COMMAND_EXECUTION]: The duplicate detection logic in
modules/issue-templates.mdinstructs the agent to execute a search command (gh issue list --search \"{{COMMAND}} OR {{ERROR_EXCERPT}}\") using raw workflow output. This pattern is vulnerable to command injection if the captured output contains shell metacharacters or malicious payloads.
Audit Metadata