workflow-engine-mapper
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides a surface for indirect prompt injection by processing untrusted user input within the
--taskargument ofscripts/workflow_engine_mapper.py. - Ingestion points: The
taskandcodeparameters are ingested as CLI arguments and stored in the script's results (e.g., inpayload['inputs']). - Boundary markers: The script does not implement specific delimiters or "ignore embedded instructions" warnings around these inputs when generating its JSON or text output.
- Capability inventory: The skill is granted
WriteandBashtools, which are intended to be used by the agent to scaffold files based on the recommendations and task details emitted by the script. - Sanitization: The script performs rigorous length and type validation (limiting tasks to 2,000 characters and runs to 1,000,000), but it does not sanitize the semantic content of the task string, which could contain instructions designed to influence the agent's downstream file-writing actions.
Audit Metadata