workflows
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill relies on external content from the repository to guide agent behavior. 1. Ingestion points: Data is ingested via the <available_workflows> context and the output of the workflows tool, which reads files from .opencode/workflows/. 2. Boundary markers: There are no explicit boundary markers or instructions telling the agent to treat workflow content as data rather than instructions. 3. Capability inventory: The skill instructs the agent to follow procedures 'step-by-step' and include 'exact commands,' facilitating the execution of arbitrary shell commands or tool calls defined in the repository. 4. Sanitization: The skill lacks any mechanism to sanitize or validate the content of the workflows before they are processed and followed by the agent.
Audit Metadata