specrail-workflow
Warn
Audited by Gen Agent Trust Hub on Jul 22, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill directs the agent to run repository-distributed scripts, specifically
checks/route_gate.py,checks/github_issue_evidence.py, andtools/install_codex_skills.py, to manage workflow states and data collection. - [COMMAND_EXECUTION]: The execution of
tools/install_codex_skills.pyallows for the installation of new functional capabilities, which represents a persistence mechanism and a potential vector for modifying the agent's operating environment if the repository is compromised. - [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting and acting upon untrusted data from external sources.
- Ingestion points: Data is ingested from external GitHub issues via the
github_issue_evidence.pyutility and from local repository files such asworkflow.yamlandPLAN.md. - Boundary markers: The instructions lack explicit delimiters or warnings to treat external content as untrusted data rather than instructions.
- Capability inventory: The agent is authorized to execute shell commands, perform file system operations, and access network resources through the provided script suite.
- Sanitization: No mechanisms are described for sanitizing, filtering, or validating the content retrieved from GitHub or local configuration files before it is processed by the agent.
Audit Metadata