workflow-from-chats
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFEPROMPT_INJECTIONNO_CODE
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its core function of processing untrusted external data (chat history) to generate executable guidance.
- Ingestion points: Parent transcripts and subagent transcripts are read from the environment (SKILL.md).
- Boundary markers: Absent. There are no explicit delimiters or instructions provided to the agent to treat the transcript content as untrusted data or to ignore embedded instructions.
- Capability inventory: The skill drafts persistent artifacts including new skills and rules. If the agent automatically adopts these, an attacker influencing chat history could effectively perform a configuration-based attack on the agent's future behavior.
- Sanitization: The skill provides instructions to filter for secrets, customer data, and credentials, but does not provide mechanisms to sanitize or validate natural language instructions found within the data corpus.
Audit Metadata