skills/edwinhu/workflows/workshop/Gen Agent Trust Hub

workshop

Pass

Audited by Gen Agent Trust Hub on Jun 22, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes local shell commands and Python scripts using the uv run utility to manage workflow gates, search for content using rg, and perform file operations like mkdir and cp.
  • [COMMAND_EXECUTION]: Utilizes dynamic context injection (the ! syntax) in SKILL.md to run a local initialization script (load-constraints.py) upon skill loading.
  • [PROMPT_INJECTION]: The skill ingests and extracts data from user-provided research papers (PDFs), creating a surface for indirect prompt injection where content within the papers could attempt to manipulate agent instructions.
  • Ingestion points: Local research paper PDF files identified in Phase 1.
  • Boundary markers: Employs targeted extraction goals for metadata and inventory rather than unconstrained reading.
  • Capability inventory: Extensive file writing capabilities and the ability to execute local scripts and compilers.
  • Sanitization: The workflow relies on structured extraction but does not explicitly demonstrate text escaping or sanitization of the extracted content.
  • [COMMAND_EXECUTION]: Dynamically generates and executes Typst code by writing presentation source files to the local file system and invoking the typst compile command to generate the final PDF output.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 22, 2026, 06:30 AM
Security Audit — agent-trust-hub — workshop