ai-automation-workflows
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The provided script examples demonstrate patterns that ingest untrusted external content directly into LLM prompts, presenting a potential vulnerability surface for indirect prompt injection.
- Ingestion points: External inputs via positional arguments (
$1) inconditional_workflow.shand raw text file content loaded via$(cat $file)indata_processing.shenter the agent prompt context dynamically. - Boundary markers: No delimiters, markers, or structural blocks are implemented to insulate system instructions from the embedded untrusted payload content.
- Capability inventory: The pipelines integrate multiple downstream model invocations and conditional actions through the
belt app runcommand. - Sanitization: No input escaping, structural schema validation, or content filtering is configured prior to prompt interpolation.
Audit Metadata