claude-workflows
Warn
Audited by Gen Agent Trust Hub on Jul 8, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill facilitates the generation and execution of JavaScript code at runtime to orchestrate sub-agents. It also describes a persistence mechanism where these scripts can be saved to specific directories (e.g., ".claude/workflows/" or "~/.claude/workflows/"), effectively creating new, persistent executable commands in the environment.
- [COMMAND_EXECUTION]: Workflow scripts orchestrate sub-agents that inherit the session's tool allowlist and run in an "acceptEdits" mode, which allows them to execute shell commands and perform filesystem modifications. This behavior applies regardless of the primary session's own permission mode, creating a potential path for broader command execution.
- [PROMPT_INJECTION]: The orchestration patterns create a significant surface for indirect prompt injection. Agents ingest and process data directly from the codebase (e.g., scanning route files or auditing endpoints) and pass results between each other to drive workflow logic, providing opportunities for instructions embedded in source files to influence agent behavior without explicit sanitization shown in the patterns.
Audit Metadata