autonomous-ui-workflow
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted code and logs from the local workspace, creating an attack surface for indirect instructions.
- Ingestion points: Repository files and build logs are accessed through tools such as
XcodeRead,XcodeGrep, andGetBuildLogas referenced inSKILL.md. - Boundary markers: The instructions do not define specific markers or guardrails to distinguish between data and instructions when reading and processing file content.
- Capability inventory: The agent is granted capabilities to perform file writes (
XcodeUpdate), project builds (BuildProject), and test execution (RunSomeTests,RunAllTests) via the Xcode MCP bridge described inSKILL.mdandagents/openai.yaml. - Sanitization: There is no mention of sanitizing or escaping external file content before it is ingested and acted upon by the agent.
Audit Metadata