workflow-runner
Pass
Audited by Gen Agent Trust Hub on Jun 21, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by processing external files to define agent behavior and tasks.
- Ingestion points: The skill reads workflow definitions from .yaml files and role instructions from .md files within the 'agency-agents-zh' directory.
- Boundary markers: There are no specific delimiters or safety warnings defined to separate interpolated file content (e.g., {{变量名}}) from the system instructions.
- Capability inventory: The agent has access to 'Bash' for directory validation, 'Read' and 'Write' for file operations, and the 'Agent' tool for spawning sub-processes.
- Sanitization: No validation or filtering is performed on the content of the YAML or Markdown files before they are used to generate prompts for the LLM or sub-agents.
- [EXTERNAL_DOWNLOADS]: The skill directs users to download agent definitions from an external source (github.com/jnMetaCode/agency-agents-zh) or via npm if they are not already present on the system.
- [COMMAND_EXECUTION]: The skill uses the 'Bash' tool to execute 'test -d' commands to locate role definition directories across several relative paths.
Audit Metadata