eachlabs-workflows
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Documentation provides curl command examples to demonstrate API interactions for workflow management, triggering, and polling for results.\n- [DYNAMIC_EXECUTION]: The workflow definition supports a python step type that allows users to define and execute Python code snippets within automated pipelines on the EachLabs cloud infrastructure.\n- [DATA_EXFILTRATION]: The skill documents the use of http steps and webhook_url parameters which facilitate the transmission of data and workflow results to external network endpoints as part of its orchestration capabilities.\n- [INDIRECT_PROMPT_INJECTION]: The workflow engine uses template syntax to interpolate user-provided data into model prompts, creating an attack surface for indirect prompt injection.\n
- Ingestion points: Workflow input_schema and trigger inputs defined in SKILL.md and WORKFLOW-EXAMPLES.md.\n
- Boundary markers: No explicit delimiters or warnings to ignore embedded instructions are used in the provided template examples.\n
- Capability inventory: The platform supports model execution, HTTP requests, and Python code execution as part of a workflow.\n
- Sanitization: There are no documented sanitization or filtering mechanisms for interpolated variables.
Audit Metadata