workflows
Pass
Audited by Gen Agent Trust Hub on Nov 3, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The system facilitates running JavaScript-based workflows within an isolated QuickJS sandbox. This sandbox is highly restricted, lacking access to the host filesystem, network, and external module loading, which prevents scripts from performing unauthorized actions.
- [INDIRECT_PROMPT_INJECTION]: The workflow framework processes data from multiple agents, which introduces a surface for indirect prompt injection.
- Ingestion points: External data is ingested via the args object and through the output of agent() calls.
- Boundary markers: The documentation emphasizes using JSON schemas to force agents into providing structured data, creating a clear boundary between model-generated prose and workflow logic.
- Capability inventory: Subagents can read the project files and, with the --write-mode allowed flag, perform file modifications.
- Sanitization: The platform includes an automated validation step for agent responses against defined schemas, ensuring data integrity before processing.
Audit Metadata