jabraf-workflows-performance-audit
Pass
Audited by Gen Agent Trust Hub on Jun 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
grepto scan local.github/workflows/*.{yml,yaml}files to identify candidate locations for adding the performance audit step. This is a read-only discovery operation.\n- [EXTERNAL_DOWNLOADS]: The skill recommends the use of a GitHub Action located atgithub.com/jabranr/workflows. This is a vendor-owned resource belonging to the author of the skill and is used for its intended purpose.\n- [PROMPT_INJECTION]: The skill reads and processes local workflow files, which creates a potential surface for indirect prompt injection if those files contain instructions designed to manipulate the agent's behavior during the discovery phase.\n - Ingestion points:
.github/workflows/*.{yml,yaml}\n - Boundary markers: None specified.\n
- Capability inventory: Local shell execution (
grep), file content reading, and generation of code snippets for user approval.\n - Sanitization: No explicit sanitization of ingested file content is performed.
Audit Metadata