workflow-extract
Pass
Audited by Gen Agent Trust Hub on Nov 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data, specifically chat transcripts and existing automation prompts from other systems.
- Ingestion points: Processes chat transcripts and external automation files (e.g., n8n flows, cron tasks) to extract workflow logic, as described in Step 1 and 2 of
SKILL.md. - Boundary markers: The skill suggests using a 'Konfigurationsblock' (Configuration Block) to separate mechanics from specific configuration values, which serves as a logical boundary but not a strict security sandbox.
- Capability inventory: The skill instructions include reading and writing to project-local files such as
REGISTRY,LOG, andTODO.md(documented inautomation-bausteine.md). - Sanitization: Step 3 ('Neutralisierung') explicitly instructs the agent to separate mechanics from configuration, providing a structural method to sanitize and abstract user-provided inputs during the extraction process.
Audit Metadata