workflow-designer
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates a process where user-provided task descriptions are formalized into "executable contracts" (markdown specifications) intended for use by downstream implementer agents. This pattern introduces an attack surface for indirect prompt injection.\n
- Ingestion points: User-provided descriptions of recurring tasks, tools, and operational boundaries gathered during Step 1 (Baseline Notes) and Step 2 (Socratic Grilling).\n
- Boundary markers: The instructions lack explicit mechanisms or delimiters to separate untrusted user input from the generated workflow logic, nor do they include instructions for the agent to ignore embedded commands within the input data.\n
- Capability inventory: The skill requires the ability to write to the filesystem, specifically creating and modifying
NOTES.mdand files within theworkflows/directory.\n - Sanitization: The procedure does not specify any validation, escaping, or filtering of the user-provided triggers and actions before they are authored into the final workflow specifications.
Audit Metadata