building-loops
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides instructions for creating workflows that process untrusted data from external integrations such as GitHub and Slack.
- Ingestion points: Untrusted data enters the workflow via
internal-eventtriggers for GitHub and Slack events, as well as general PostHog event triggers defined inSKILL.md. - Boundary markers: The documentation explicitly advises using a labeled, escaped
<triggering_event>block to separate data from instructions, rather than using direct template interpolation. - Capability inventory: The workflows utilize the
create_taskfunction, which has the capability to access code repositories and MCP connections. - Sanitization: The skill recommends referencing property names instead of rendering raw property values directly into the instruction prompt to prevent malicious actors from influencing the agent's behavior.
Audit Metadata