parallel-goal-workflows
Pass
Audited by Gen Agent Trust Hub on Aug 4, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill follows security best practices for multi-agent workflows by enforcing context isolation ('fork_context: false') and task sanitization.
- [PROMPT_INJECTION]: The instructions explicitly require the agent to 'Synthesize the task instead of pasting the user's wording' when creating briefs for subagents. This process acts as a security boundary by stripping potentially malicious formatting or injection attempts from the original user input.
- [DATA_EXFILTRATION]: No network commands (curl, wget, etc.) or sensitive data access patterns were found. The skill documentation references official OpenAI developer domains for configuration guidance, which are trusted sources.
- [COMMAND_EXECUTION]: The repository includes a Python script (
evals/check_identity_packet.py) used for automated testing of the skill's logic. Analysis of the script confirms it only performs local file read operations on the skill's own directory to verify content integrity. - [INDIRECT_PROMPT_INJECTION]: While the skill processes user-supplied data, it mitigates indirect injection risks by providing structured templates for local briefs and instructing agents to focus only on task-relevant facts and constraints.
Audit Metadata