Study of 1,248 GitHub Agentic Workflow files: median 556 words, still edited in month 4, only 9.4% address prompt injection
arXiv 2609.27263 + GitHub Agentic Workflows safe-outputs docs·medium signal
The authors mined 276 repos using gh-aw Markdown workflows. Instructions are long specs, not prompts: median 556.5 words, and 62.1% contain code blocks. 78.2% of files were still being updated in month 4. Tasks, outputs and constraints appear in over 93% of workflows, but only 9.4% mention prompt-injection defense. gh-aw's own docs provide safe outputs and a threat-detection job between the agent and its writes, so turn those on and treat workflow Markdown as maintained code.