fork-fleet
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill fetches the content of
SKILL.mdfiles from third-party forks and synthesizes them into short descriptions (Step A4). An attacker who controls a fork could insert malicious instructions into theirSKILL.mdto influence the agent's behavior during this summarization process. - Ingestion points: Forked
SKILL.mdfiles retrieved via the GitHub API (gh api) in Step A4. - Boundary markers: The instructions do not specify any delimiters or safety prompts to isolate the external content from the agent's core logic.
- Capability inventory: The skill has access to the local file system for logging and article generation, the
notifytool for alerting users, and the GitHub API for read/write operations. - Sanitization: No explicit sanitization or validation of the fetched markdown content is performed before the agent processes it for synthesis.
- [COMMAND_EXECUTION]: The skill makes extensive use of shell commands and the GitHub CLI (
gh api) to perform its monitoring tasks. These tools, while used for legitimate purposes, provide the agent with significant operational capabilities that are exercised when processing data derived from untrusted external sources.
Audit Metadata