workflow
Warn
Audited by Gen Agent Trust Hub on Jun 19, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Potential Python code injection in Phase 1. The instruction to substitute raw user input into a triple-quoted string (
"""<<USER_ARGS>>""") within a Python script allows an attacker to escape the literal string context and execute arbitrary code on the local system. - [PROMPT_INJECTION]: Indirect prompt injection surface.
- Ingestion points: Untrusted workflow YAML file contents and user-supplied input arguments defined in Phase 1 and Phase 2 of
SKILL.md. - Boundary markers: The prompt template used to invoke the subagent in Phase 4 does not wrap the interpolated step arguments in secure delimiters or provide instructions to the subagent to ignore embedded commands within the data.
- Capability inventory: The skill possesses extensive capabilities including subagent creation (
Agenttool), shell execution (Bash), and file system access (Read,Write,Glob), which can be misused if a malicious workflow triggers unintended actions. - Sanitization: The skill performs basic structural validation (regex for step IDs,
shlex.splitfor tokens) but lacks sanitization of the content values passed into the subagent's execution context.
Audit Metadata