agent-workflow-packager
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the creation of new instructions by ingesting and re-packaging untrusted data from external sources such as user-provided prompts, runbooks, and checklists.
- Ingestion points: In
SKILL.md, Step 1 describes extracting workflow data from user-provided artifacts including PR URLs, test outputs, issues, and manual steps. - Boundary markers: Step 3 and Step 6 specify adding constraints to prevent overreach, requiring user approvals for sensitive actions, and including verification checklists in the generated output.
- Capability inventory: The skill's primary function is generating textual instruction files (
SKILL.md). Across all files, there are no instances of direct command execution, subprocess spawning, file system writing (beyond the generation task), or network exfiltration. - Sanitization: The instructions do not define methods for sanitizing, escaping, or validating the input data before it is interpolated into the generated skill package, which could allow malicious instructions in the source workflow to persist in the output.
Audit Metadata