design-workflow
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests content from a local file named
NOTES.mdto inform its design process. While this creates an attack surface where instructions inside the notes could influence the agent's behavior, the risk is inherent to the skill's function as a context-aware assistant. - Ingestion points: Reads internal raw data from
NOTES.md(as specified in SKILL.md). - Boundary markers: Absent; the agent is instructed to directly incorporate identified terminology and facts from the notes into the workflow specifications.
- Capability inventory: File system read/write permissions are limited to the workspace for creating
workflows/*.mdfiles. There are no network or execution capabilities. - Sanitization: Absent; information from external raw notes is processed and refined based on user interview input.
Audit Metadata