workflow-doctor
Pass
Audited by Gen Agent Trust Hub on Nov 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill audits several local files and incorporates their content or diagnostic results into the agent's response, creating a surface for indirect prompt injection.
- Ingestion points: Processes content from rule-maker/INSTALLATION.md, design.md, CONTRACT.md, VERIFY.md, LIVE-KIT.md, and STATUS.md, as well as outputs from various local scripts.
- Boundary markers: Absent. There are no instructions to the agent to treat audited file content as untrusted or to ignore instructions embedded within them.
- Capability inventory: The skill can execute local Python scripts (global_policy.py, audit_installation.py, etc.) and read from the file system.
- Sanitization: Absent. No explicit sanitization or validation of the data read from files before it is processed by the agent.
- [DATA_EXFILTRATION]: The skill accesses sensitive environment configuration directories to perform its audit.
- Evidence: It is instructed to inspect CLAUDE_CONFIG_DIR, CODEX_HOME, and host profile/registrations. These locations may contain sensitive metadata about the agent's setup and credentials.
- [COMMAND_EXECUTION]: The skill executes multiple local scripts to gather diagnostic data.
- Evidence: Commands include workflow/scripts/global_policy.py --check, scripts/audit_installation.py --check-global, and rule-maker/scripts/rules_stamp.py. These executions are intended for read-only auditing and use specific check flags.
Audit Metadata