workflow-from-chats
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted input from chat transcripts to generate new instructions, which represents a potential surface for indirect prompt injection.
- Ingestion points: The agent reads parent and subagent chat transcripts from the local environment to identify user preferences.
- Boundary markers: The skill instructions include explicit negative constraints to avoid exposing secrets, credentials, or private content, although it does not define technical delimiters for the ingested data.
- Capability inventory: The skill utilizes the agent's ability to read existing transcript files and write new configuration artifacts (skills, rules, or documentation) to the file system.
- Sanitization: The workflow relies on logical filtering, such as confidence ratings and relevance clustering, to distinguish durable preferences from anecdotal or malicious content.
Audit Metadata