re0-workflow
Pass
Audited by Gen Agent Trust Hub on Nov 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input (the "stated intent") to drive its logic for selecting, ordering, and invoking other installed skills.\n
- Ingestion points: The workflow begins by reading a human's stated intent from the conversation context.\n
- Boundary markers: The instructions do not specify any delimiters or safety wrapping for the intent string when it is passed to other skills in the pipeline.\n
- Capability inventory: The skill has the authority to invoke any other installed skill via the platform's
Skilltool, potentially triggering file system operations or network activity depending on the target skills' capabilities.\n - Sanitization: No explicit validation or filtering is performed on the intent string before it is utilized in the
Skilltool calls.\n - Mitigation: The skill significantly reduces risk through human-in-the-loop requirements, such as forcing a
user-handofffor all destructive operations and requiring explicit plan approval for any step that writes artifacts or files.
Audit Metadata