jabraf-workflows-integration
Pass
Audited by Gen Agent Trust Hub on Jun 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [SAFE]: The skill follows security best practices by implementing a human-in-the-loop workflow. It requires the user to acknowledge and confirm all detected configurations and proposed file writes at multiple stages of the conversation.
- [COMMAND_EXECUTION]: The agent uses the
grepcommand to search for existing workflow callers in the.github/workflows/directory. This is used for discovery purposes to prevent silent overwriting of configuration. - [EXTERNAL_DOWNLOADS]: The skill references reusable workflows from the
jabranr/workflowsrepository. These are author-owned resources used for the intended purpose of the skill. The instructions include a section on pinning to a specific commit SHA for better security and stability. - [PROMPT_INJECTION]: While the skill reads untrusted project data (like
package.json), the risk of indirect prompt injection is mitigated by the strict requirement for user confirmation before the final YAML file is written.
Audit Metadata