building-workflows
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from PostHog events and person properties, which is then used in workflow configurations and test runs. It has capabilities to send emails, SMS, and push notifications, and to modify workflows.
- Ingestion points: Untrusted data enters the context through
globalsin theworkflows-test-runtool andinvocation_globalsretrieved viaworkflows-get-invocation. - Boundary markers: Absent.
- Capability inventory: The agent can create, modify, and enable workflows (
workflows-create,workflows-patch-graph,workflows-enable), perform batch broadcasts (workflows-run-batch), and send communications via email, SMS, and push notification integrations. - Sanitization: There are no instructions for sanitizing or validating the contents of properties like
{person.x}or{event.x}before they are interpolated into workflow configurations or test runs.
Audit Metadata