workflow-onboard
Warn
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands
git logandgit diffto gather context from the repository history. - [DATA_EXPOSURE_AND_EXFILTRATION]: The skill accesses sensitive file paths, specifically
.env.localand.env.example, to extract environment variable names. While the instructions explicitly state to never print values, the access to the file itself represents a potential exposure risk. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the repository (README files, SQL migrations, manifests). A malicious codebase could include instructions in these files to hijack the agent's behavior. 1. Ingestion points: Reads
README.md,package.json,supabase/migrations/*.sql, and other repository files. 2. Boundary markers: No explicit boundary markers or 'ignore embedded instructions' warnings are used when processing the files. 3. Capability inventory: Includes shell command execution (git) and file reading across the codebase. 4. Sanitization: No sanitization or filtering of external content is specified before processing.
Audit Metadata