arduino-workflow-router
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes complex, user-defined embedded project requirements to determine the appropriate specialist workflow (SKILL.md). Instructions embedded within project documentation or board profiles provided by a user could potentially be interpreted as system commands, influencing the agent's routing decisions.
- Ingestion points: User-supplied project descriptions, board constraint specifications, and electronics requirements.
- Boundary markers: The skill references an external contract ('arduino-skill-contract.md') to define evidence and output expectations.
- Capability inventory: The router specializes in workflow orchestration and documentation; it does not execute shell commands or perform network requests directly.
- Sanitization: The instructions mandate that the agent explicitly label assumptions and request user verification before performing physical actions like flashing firmware.
- [SAFE]: The 'connected-device-security.md' reference provides comprehensive security guidance, including secret management (avoiding hardcoded API keys/passwords), firmware signing, and SBOM generation.
Audit Metadata