action-converter
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes the GitHub CLI (
gh pr list) to retrieve open pull requests and a local script (./notify) to deliver the finalized action list. These commands are integral to the skill's stated purpose of project management and notification. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources that could theoretically contain malicious instructions.
- Ingestion points: Output from
gh pr list(PR titles),memory/topics/files,memory/logs/, andoutput/articles/metadata. - Boundary markers: The skill does not use explicit delimiters or "ignore instructions" wrappers for the ingested data.
- Capability inventory: The skill possesses file read/write capabilities and the ability to execute the
ghtool and./notifyscript. - Sanitization: The skill implements robust "specificity gates" and a "banned-phrase lint" that perform semantic validation on the output. These gates ensure that only concrete, entity-specific actions are generated, which significantly limits the effectiveness of indirect prompt injection attacks.
Audit Metadata