rollback-workflow-builder
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill includes GitHub Action workflow templates that are susceptible to command injection via unsanitized user inputs.\n
- Ingestion points: The templates in
SKILL.mdingest untrusted data from GitHub Workflow inputs such asversion,environment, andreason.\n - Boundary markers: There are no delimiters or explicit instructions in the generated templates to separate user-provided data from executable command logic.\n
- Capability inventory: The provided workflows in
SKILL.mdutilize shell execution (runsteps), Docker CLI commands, and theactions/github-scriptruntime.\n - Sanitization: The templates interpolate user inputs directly into shell strings (e.g.,
echo "Reason: ${{ github.event.inputs.reason }}") without escaping or validation, which could allow arbitrary command execution on the runner environment.\n- [EXTERNAL_DOWNLOADS]: The workflow templates reference official GitHub Actions for standard deployment tasks.\n - Evidence: The skill references
actions/checkout@v4,actions/setup-node@v4,azure/setup-kubectl@v3, andactions/github-script@v7inSKILL.md.\n - Context: These references target official repositories from well-known service providers and represent standard industry practices for CI/CD automation.
Audit Metadata