workflow-yylo
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes workflow records fetched from an external source and user input, creating a potential surface for indirect prompt injection.\n
- Ingestion points: Data retrieved via
yy ledger workflow searchorgetinSKILL.md, and user-provided input passed through the$ARGUMENTSplaceholder.\n - Boundary markers: The skill instructions include use of the
--validatedflag and explicit warnings against storing executable shell as a substitute for validated data.\n - Capability inventory: Uses the
yy ledgerCLI for searching, retrieving, and creating workflow records.\n - Sanitization: Enforces strict YAML validation, rejecting unsafe structures like aliases or anchors, and utilizes schema-based normalization (
schema_version: v1).\n- [COMMAND_EXECUTION]: The skill employs vendor-specific CLI tools (yy ledger,yylo-ledger) to interact with the ledger system. These commands are necessary for the skill's primary function of workflow record management.
Audit Metadata