anth-core-workflow-a
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides templates for creating an agentic loop that processes output from external functions (Step 3 and Step 4) and re-injects that data into the AI model's context window. This pattern is vulnerable to indirect prompt injection if the external data sources (like weather APIs or product databases) are compromised or return attacker-controlled instructions.
- Ingestion points: The
tool_resultsarray passed toclient.messages.createin Step 3 and Step 4. - Boundary markers: The skill uses standard Anthropic Messages API
tool_resultcontent blocks, which provide structural separation but do not filter the semantic content for embedded instructions. - Capability inventory: The skill acts as a routing framework for tools; specific capabilities (like network access or file operations) would be implemented within the
execute_toolfunction by the end user. - Sanitization: The provided example code does not demonstrate sanitization, filtering, or validation of the data returned by the tool implementations before feeding it back to the assistant.
Audit Metadata