anima-core-workflow-b
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data fetched from external websites, which creates a potential surface for indirect prompt injection attacks.
- Ingestion points: External data enters the workflow in
src/workflows/website-to-code.tswhen cloning content from public URLs. - Boundary markers: The instructions do not define clear delimiters or "ignore embedded instructions" warnings to prevent the agent from following directions hidden within the source website's code or text.
- Capability inventory: The skill possesses the capability to perform local file system operations, including directory creation (
fs.mkdirSync) and file writing (fs.writeFileSync) as seen insrc/workflows/organizer.ts. - Sanitization: The skill lacks sanitization or validation mechanisms to filter out potential prompt injection patterns from the website content before it is passed to the AI for customization and organization tasks.
Audit Metadata