ai-automation-workflows
Pass
Audited by Gen Agent Trust Hub on Aug 8, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [PROMPT_INJECTION]: The skill documents templates for processing external data that are vulnerable to indirect prompt injection.
- Ingestion points: The 'Data Processing Pipeline' template uses '$(cat $file)' to read external file content, and the 'Conditional Workflow' uses '$INPUT_TEXT' for branch logic.
- Boundary markers: Absent. The external content is directly interpolated into JSON prompt strings without delimiters.
- Capability inventory: The agent can execute 'belt' CLI commands which interact with external AI models and perform local file operations.
- Sanitization: Absent. No escaping or validation is present in the provided templates.- [COMMAND_EXECUTION]: The skill provides instructions for persistent execution and complex scripting.
- Evidence: The 'Scheduled Automation' section provides instructions for creating 'crontab' entries to execute automation scripts persistently across reboots and sessions.- [EXTERNAL_DOWNLOADS]: The skill recommends installing several external components and skills from remote sources.
- Evidence: Recommends 'npx skills add' for 'belt-sh/cli' and multiple skills under the 'inference-sh/skills' repository. The 'Quick Start' section also points to an external GitHub URL for installation guidelines.- [DATA_EXFILTRATION]: The skill includes a pattern for sending command execution metadata to external network endpoints.
- Evidence: The 'monitored_workflow.sh' template provides an example using 'curl' to POST command results and error logs to a user-defined webhook URL.
Audit Metadata