skill-repair
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill represents a significant attack surface for indirect prompt injection. Ingestion points: Processes data from memory/logs/*.md, memory/issues/INDEX.md, memory/cron-state.json, and outputs from gh run view and gh api. Boundary markers: Lacks explicit delimiters or instructions to ignore embedded commands when processing external data. Capability inventory: Possesses powerful capabilities including file system modification, Git operations, and GitHub repository management. Sanitization: No evidence of filtering or validation of ingested content before using it to inform code modifications.
- [COMMAND_EXECUTION]: The skill dynamically generates shell commands using variables like {name} and $RUN_ID derived from files and command outputs. This pattern could lead to command injection if the source data is manipulated to include shell metacharacters.
Audit Metadata