stelow-workflow-interface-alternatives
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local shell commands to manage workflow state and process design artifacts. It uses standard utilities like
ls,grep, andawk, alongside custom project tools likevisual_reviewandstelowto automate transitions between design phases. - [DYNAMIC_EXECUTION]: Sourced configuration and logic are loaded from computed relative paths (e.g.,
../../stelow-workflow-orchestrator/references/cli-tools/read-config.sh). This allows the skill to share utilities with other components in the workflow suite but introduces a dependency on the local file system structure. - [INDIRECT_PROMPT_INJECTION]: The skill processes project-specific files like
spec-product.mdandtech-recon.mdto determine the scope and constraints of the design task. This creates a potential surface where untrusted data in these files could influence agent behavior. - Ingestion points: Contents of
spec-product.mdandtech-recon.mdare loaded into the context for subagents. - Boundary markers: None defined; the agent is instructed to read the files directly.
- Capability inventory: Includes shell command execution, file system writes, and the ability to invoke subagents.
- Sanitization: No explicit sanitization or validation of the input file content is performed before processing.
Audit Metadata