goodissues-reporter
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes several build and package management commands including
mix deps.get,mix compile, andmix ecto.migrate. These are standard Elixir/Phoenix workflow commands necessary for installing dependencies and setting up the project environment. - [EXTERNAL_DOWNLOADS]: The skill adds a dependency to
mix.exsthat fetches code directly from the vendor's GitHub repository (agoodway/goodissues_reporter). This is the intended behavior for integrating the specified tool. - [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it reads and parses local project files (
mix.exs,lib/directory) to determine the current project state and apply configuration changes. - Ingestion points: Reads
mix.exsand files within thelib/andconfig/directories. - Boundary markers: None explicitly defined in the instructions for the data being read.
- Capability inventory: The skill can write to configuration files (
runtime.exs,dev.exs,test.exs), modify source code (application.ex,router.ex), and execute shell commands (mix). - Sanitization: No specific sanitization or validation of the project file content is described before using it to drive the workflow.
Audit Metadata