pm-workflow
Pass
Audited by Gen Agent Trust Hub on Mar 24, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill ingests data from external sources including
prd.json, CLI arguments ($arguments.message), and session files (./.claude/session/pending-messages-pm.json), creating a surface for indirect prompt injection. - Ingestion points: Data from worker responses and project state files are read during the 'Agent Startup Protocol' and 'Result Processing' phases.
- Boundary markers: No delimiters or safety instructions are provided to help the agent distinguish between its own logic and potentially malicious instructions embedded in the ingested data.
- Capability inventory: The agent can invoke multiple sub-agents and has the authority to write to other skill files.
- Sanitization: No evidence of sanitization, validation, or escaping of input data was found.
- [COMMAND_EXECUTION]: The 'File Permissions' section explicitly allows the skill to write to 'Agents and Subagents skill files for improvements.' This capability for cross-skill modification is a powerful feature that could be exploited to inject persistent malicious logic into other agents if the PM agent is compromised through indirect prompt injection.
Audit Metadata