using-workflows
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The workflows utilize the
agent()function to execute shell commands for various tasks, including managing PRs with the GitHub CLI (gh), driving external agents viaagent-tmux, and running project-specific scripts. This behavior is central to the skill's purpose of automating developer operations. - [INDIRECT_PROMPT_INJECTION]: Several recipes (e.g.,
pr-review-triage-resolve,docs-vs-code-audit,design-vs-code-audit) ingest and process untrusted external data such as PR comments, documentation, and source code. This represents a potential surface for indirect prompt injection. - Ingestion points include PR threads, local files, and remote repository data.
- The skill implements robust mitigation strategies, including multi-agent consensus loops, adversarial review phases where a separate 'critic' agent attempts to refute findings, and a strict 'doctrine' requiring verification against ground truth (source code and logs).
- Boundary markers like triple-backticks and JSON serialization are used to delimit external content.
- [REMOTE_CODE_EXECUTION]: The skill facilitates remote and script execution as part of its workflow orchestration.
pr-review-triage-resolve.workflow.jsexecutes a repo-relative script specified by the user to trigger review bots.workflow-manifest.workflow.jsuses SSH to inventory and classify workflow scripts across multiple remote machines.- These capabilities are documented and appear to be intended for large-scale development environments and fleet management.
Audit Metadata