workflow-from-chats
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data (chat transcripts) to create persistent agent configuration artifacts like skills and rules.
- Ingestion points: The workflow explicitly scans recent chat transcripts and subagent transcripts in steps 2 and 3 of the SKILL.md file.
- Boundary markers: There are no explicit markers or delimiters defined to prevent the agent from mistaking instructions inside the chat transcripts for legitimate workflow preferences.
- Capability inventory: The skill has the capability to write and modify files (skills, rules, workflow docs) as described in the 'Artifact Choice' section.
- Sanitization: While the skill provides instructions to avoid exposing secrets or private data, it lacks mechanisms to sanitize or filter out malicious instructions that might be embedded in the chat history.
Audit Metadata