workflow
Pass
Audited by Gen Agent Trust Hub on Jul 2, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches development environment configurations from the official Temporal GitHub repository.
- [COMMAND_EXECUTION]: Provides detailed guidance on using the Temporal CLI and the
uvpackage manager for workflow lifecycle management and project setup. - [PROMPT_INJECTION]: The templates demonstrate how to ingest external data into workflows. This establishes a surface for indirect prompt injection if the user-provided data (e.g., API URLs or email bodies) is not sanitized before being processed by activities.
- Ingestion points: Workflow input parameters and activity arguments such as the URL in the
call_apiactivity. - Boundary markers: None are explicitly defined in the provided code templates.
- Capability inventory: Network access via
httpx, workflow execution control, and system interaction via CLI examples. - Sanitization: The templates do not include explicit input validation or escaping for external content.
- [SAFE]: No malicious patterns, obfuscation, or persistence mechanisms were detected. The skill correctly advises the use of environment variables for managing sensitive TLS certificates and keys.
Audit Metadata