Only 9.4% of 1,248 GitHub Agentic Workflow files mention prompt-injection defense.

A study across 276 repos using gh-aw Markdown workflows found instruction files with a median of 556.5 words, 62.1% containing code blocks, and 78.2% still being edited in month four (arXiv). Tasks, outputs and constraints show up in over 93% of them. Injection defense in fewer than one in ten. gh-aw ships safe outputs and a threat-detection job between the agent and its writes. Turn both on, and treat workflow Markdown as maintained code, because the edit data says it already is.