specialized-workflow-architect
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFECREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill instructions direct the agent to "Read every config and environment file" to discover lifecycle and state assumptions. Environment files, such as
.env, frequently contain sensitive information including API keys, database credentials, and secret tokens. Reading these files exposes these credentials to the agent's context. - Evidence: The "Discover Workflows That Nobody Told You About" section explicitly includes "Read every config and environment file" as a core discovery task.
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and synthesize information from a variety of external project files (source code, migrations, IaC, etc.). This creates a vulnerability where instructions embedded within the analyzed files could manipulate the agent's output or behavior.
- Ingestion points: API routes (
src/routes/), background workers, database migrations, infrastructure-as-code modules (.tf,docker-compose.yml), and configuration files. - Boundary markers: No boundary markers or specific delimiters are used to separate untrusted file content from the agent's instructions.
- Capability inventory: The agent uses shell commands (
grep,find) to locate and read files, and is tasked with generating detailed specifications based on that data. - Sanitization: The instructions do not define any sanitization, filtering, or validation for the content read from external files.
Audit Metadata