plugin-workflow
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill coordinates the plugin lifecycle by executing a local Node.js script (
scripts/plan-workflow.mjs) to generate menus and workflow ledgers. The script is used strictly for deterministic planning and validation based on a local schema.- [INDIRECT_PROMPT_INJECTION]: The skill manages a workflow that ingests user selections and repository metadata, which represents a potential injection surface. - Ingestion points: The skill processes user-provided natural language selections and JSON configuration files via the bundled planner script.
- Boundary markers: The instructions explicitly define and enforce three major confirmation boundaries (Repository writes, Dependency/runtime execution, and External publication) that must be approved by the user before transitioning to executable phases.
- Capability inventory: The skill restricts its own logic to read-only discovery and planning, delegating all write and execution capabilities to specific owning skills ($plugin-upgrade, $plugin-write, etc.).
- Sanitization: All selection inputs are validated against a formal JSON schema (
references/workflow-selection.schema.json) using strict enum and property checks within the Node.js planner logic.
Audit Metadata