workflow-router
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill interpolates user-supplied goals and task descriptions directly into the prompts for specialist subagents. It also consumes shared implementation plans from the filesystem, which could contain instructions intended to influence the subagents' behavior.\n
- Ingestion points: Task descriptions and goals from user interaction; implementation plans at
thoughts/shared/plans/*.md(referenced in Step 2 and Build workflow).\n - Boundary markers: The skill does not use specific delimiters or instructions to the subagents to ignore potential injection patterns within the interpolated data strings.\n
- Capability inventory: The skill can spawn multiple specialist agents (Task tool) and execute shell commands to inspect the filesystem.\n
- Sanitization: No evidence of input validation or escaping for the user-provided strings before they are passed to subagents.\n- [COMMAND_EXECUTION]: The skill uses a shell command to check for the existence of plan files in the workspace.\n
- Evidence: Verbatim use of
ls thoughts/shared/plans/*.md 2>/dev/nullto detect existing implementation plans in Step 2.
Audit Metadata