workflow-scan
Pass
Audited by Gen Agent Trust Hub on May 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes
trellis -vto resolve project paths and versions, which is a required functional step for locating the analysis target. - [SAFE]: The skill operates exclusively on the local filesystem within a predefined temporary directory structure. No network activity or exfiltration patterns were identified.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the local project files, creating an attack surface where content from scanned files could influence the generated report.
- Ingestion points: Local files in
/tmp/trellis-{VERSION}-2/, including workflow documentation and script metadata (SKILL.md). - Boundary markers: Absent; the skill summarizes scanned content without using delimiters to isolate it from instructions.
- Capability inventory: Shell execution of
trellis -vand local filesystem access (SKILL.md). - Sanitization: Absent; content from the scanned project is directly used to populate the findings and analysis summary.
Audit Metadata