layer-workflow-import
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data which constitutes a potential injection surface. 1. Ingestion points: Exported workflow files, node-graph JSON, screenshots, and prose descriptions (SKILL.md). 2. Boundary markers: Absent. 3. Capability inventory:
import_workflow,execute_workflow,upload_file, andnpx skills add(SKILL.md). 4. Sanitization: The instructions require translating input into a strictgraphschema and mandatory use ofimport_workflowwithvalidate_only: truefor structural validation before execution. - [COMMAND_EXECUTION]: The skill instructs the agent to handle missing dependencies by suggesting the use of
npx skills add layerai/skills. This command targets the official vendor repository for platform-specific capabilities and represents standard environment management.
Audit Metadata