workflow-router
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill performs repository reconnaissance, which involves reading untrusted data from local files that could contain hidden instructions targeting the agent.\n
- Ingestion points: The skill reads repository structure, README/CONTRIBUTING files, build/test frameworks, CI configurations, git logs, docs/ layout, ADRs, and project-specific instructions like AI_ENGINEERING_WORKFLOW.md, AGENTS.md, and CLAUDE.md.\n
- Boundary markers: There are no explicit delimiters or instructions provided to the agent to distinguish between the skill's own logic and potentially adversarial content within the ingested files.\n
- Capability inventory: The skill has the ability to propose file-by-file edits, report commands, and invoke downstream pipelines such as subagent-pipeline based on its findings.\n
- Sanitization: The skill mitigates risks by requiring explicit human approval: it states 'Ask for approval before writing any instruction, config, label, or tracker change' and makes 'Approval required: yes' mandatory for any proposed changes.
Audit Metadata