issue-triage
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from GitHub issues and comments, creating a surface for indirect prompt injection attacks.
- Ingestion points: Data is gathered from external sources via
gh issue listandgh apiinSKILL.md(Phase 1). - Boundary markers: The instructions lack explicit delimiters or instructions to ignore embedded commands when the subagent processes the issue body and comments in
SKILL.md(Phase 2). - Capability inventory: The skill has the ability to execute shell commands via
bash, post comments (gh issue comment), modify labels (gh issue edit), and close issues (gh issue close) inSKILL.md(Phase 3). - Sanitization: There is no evidence of sanitization or escaping of the issue body content before it is interpolated into the prompt for the analysis subagent.
- Mitigation: The skill significantly reduces risk by requiring explicit user validation through
AskUserQuestionbefore any destructive or modifying actions are performed on the repository. - [COMMAND_EXECUTION]: The skill uses the GitHub CLI (
gh) and standard Unix utilities (bash,grep,pbcopy) to perform its tasks. While these are appropriate for the skill's purpose, they represent the execution of shell commands based on the skill's logic.
Audit Metadata