i4h-workflow-create
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local shell and Python scripts, specifically
./scripts/create_blank_environment.py,run.sh, andpytest, to automate the generation and validation of workflow environments. These tools are restricted to the local workspace.\n- [INDIRECT_PROMPT_INJECTION]: The skill accepts user-supplied parameters for workflow naming and specialty selection which are processed by command-line utilities.\n - Ingestion points: User-provided
workflow_idandspecialtystrings are used as arguments for the environment creation script inSKILL.md.\n - Boundary markers: The instructions provide clear constraints, requiring the ID to be in lowercase snake_case and the specialty to be selected from a predefined list.\n
- Capability inventory: The skill is capable of generating structured Python and YAML files for the Scene, Arena, and Workflow components and executing contract tests.\n
- Sanitization: The scaffolding script is designed to be overwrite-safe and performs checks to ensure the requested workflow ID does not conflict with existing public workflows before creating any files.\n- [SAFE]: All identified external references, such as the authoring team email and the container registry URL in the benchmark documentation, are official NVIDIA-owned resources and do not represent security risks.
Audit Metadata