workflow-green-repo
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill has an indirect prompt injection surface as it processes untrusted data from the repository to determine its logic. 1. Ingestion points: In Phase 0, the agent reads project files including package.json, Makefile, justfile, .github/workflows/*, AGENTS.md, CLAUDE.md, and README to identify execution commands. 2. Boundary markers: The instructions lack delimiters or explicit warnings for the agent to ignore instructions embedded within the processed data. 3. Capability inventory: The skill involves both shell command execution (Phase 0/3) and file writing (Phase 2). 4. Sanitization: There is no sanitization or verification mechanism for the commands discovered in repository configurations before they are executed by the agent.
- [COMMAND_EXECUTION]: The skill requires the agent to run arbitrary shell commands defined in the repository's configuration files. Evidence: Phase 0 and Phase 3 direct the agent to 'Identify the exact commands' and 'run each gate' for typechecking, linting, testing, and building, which are typically defined in project-controlled files like package.json or Makefile.
Audit Metadata