openserv-multi-agent-workflows
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The workflow orchestration patterns described in the documentation and example setup scripts are susceptible to indirect prompt injection attacks.
- Ingestion points: Webhook triggers defined in numerous example files (e.g.,
examples/blog-pipeline.md,examples/content-creation-pipeline.md,examples/crypto-alpha-pipeline.md) accept arbitrary string inputs such astopic,symbol, andyoutube_urlfrom external callers. - Boundary markers: The provided examples (e.g.,
setup.tsscripts) do not use delimiters or "ignore embedded instructions" warnings when interpolating external data into task body strings (e.g.,input: '{{trigger.topic}}'). - Capability inventory: The workflows orchestrate marketplace agents (such as Grok or Perplexity) which have capabilities for web searching, social media analysis, and report generation. The setup scripts utilize the Platform Client to manage workflow states and authenticate using sensitive blockchain private keys.
- Sanitization: The setup scripts lack explicit sanitization, validation logic, or schema enforcement to filter potential malicious instructions embedded within the incoming trigger data before it is processed by the downstream agents.
Audit Metadata