workflow-builder
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes workflow prompts from the local filesystem to orchestrate sub-agents. Malicious content in these files could influence agent behavior. \n
- Ingestion points: The runner reads context.md and step markdown files from the .somnio/workflows/ directory. \n
- Boundary markers: No delimiters or protective instructions are used to separate potentially untrusted content from the orchestrator's instructions. \n
- Capability inventory: The skill utilizes the Agent tool for sub-agent management and the Bash tool for filesystem tasks. \n
- Sanitization: No validation or escaping of step content or resolved placeholders is performed during prompt assembly. \n- [DYNAMIC_EXECUTION]: The orchestrator dynamically constructs prompts for sub-agents at runtime, incorporating resolved file paths and shell command instructions (like mkdir -p). This dynamic assembly creates a potential injection surface if the resolved values are not properly handled. \n- [COMMAND_EXECUTION]: The skill explicitly instructs sub-agents to execute shell commands via the Bash tool to create directories and manage workflow outputs on the disk.
Audit Metadata