workflow-orchestration
Pass
Audited by Gen Agent Trust Hub on May 12, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: Indirect prompt injection vulnerability surface detected in the sub-agent orchestration flow.
- Ingestion points: The skill reads user-controlled data from ticket files located in
.kanban/open/T-NNN.xmland.kanban/progress/T-NNN.xml, which contain goals, constraints, and context fields. - Boundary markers: Instructions for sub-agents (e.g., planner, worker) interpolate the user's request directly into prompt strings without utilizing specific delimiters or "ignore previous instructions" guards.
- Capability inventory: The system possesses high-impact capabilities including file system write access, execution of various shell scripts (via aliases), and the ability to dispatch further sub-agents.
- Sanitization: There is no explicit logic described for validating or escaping the contents of the XML ticket files before they are injected into sub-agent prompts.
Audit Metadata