workflows-finalize
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and analyzes untrusted data from the repository's working copy and PR diffs, creating a surface where malicious instructions embedded in source files could influence agent behavior. \n
- Ingestion points:
SKILL.md(Step 1) directs the agent to read changed files, callers, tests, schemas, and configuration files in full. \n - Boundary markers: The instructions do not define specific delimiters or directives to ignore instructions that might be embedded within the source code being analyzed. \n
- Capability inventory:
SKILL.md(Step 3 and Step 5) authorizes the agent to modify local files, run build commands, and execute repository-specific test suites. \n - Sanitization: No sanitization or validation of the ingested code content is specified before the model processes it.
Audit Metadata