workflow
Warn
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: Argument parsing in Phase 1 uses direct string interpolation of user input into a Python script template (
<<USER_ARGS>>). A malicious user can provide input with triple quotes to break out of the string literal and execute arbitrary Python code. - [COMMAND_EXECUTION]: The workflow name extracted from the YAML file is used in shell commands without proper sanitization, which could lead to command injection if the name contains shell metacharacters.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted YAML data and interpolates it into subagent prompts without sanitization.
- Ingestion points: User-provided workflow YAML file at a variable path.
- Boundary markers: None present in subagent prompts to distinguish instructions from untrusted workflow data.
- Capability inventory: The skill has access to shell execution (Bash, PowerShell) and agent spawning.
- Sanitization: None; arguments and descriptions from the YAML are passed directly to subagents.
- [DYNAMIC_EXECUTION]: The skill generates and executes Python scripts at runtime for its core logic (parsing, validation, planning), increasing the potential for injection attacks if placeholders are not safely handled.
Audit Metadata