signals-scout-workflows
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection by ingesting and acting upon user-supplied feedback from workflow rejection reasons.
- Ingestion points: The skill reads the
rejection_reasonfield from theworkflows-list-proposalstool output (documented inSKILL.md). - Boundary markers: No explicit delimiters or instruction-ignore warnings are defined for the processing of this external text.
- Capability inventory: The skill possesses the capability to file new workflow modifications via the
workflows-suggesttool. - Sanitization: The instructions do not specify any sanitization or validation of the content within the
rejection_reasonbefore it is used to influence the agent's next proposal. - Mitigation: The risk is significantly reduced by the architectural design requiring a human user to manually approve any suggestion before it becomes a draft or is published.
Audit Metadata