land-stack

Pass

Audited by Gen Agent Trust Hub on Sep 3, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses the GitHub CLI (gh) to manage pull requests and issues, and the internal bb tool to archive environment worktrees.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes content from potentially untrusted external sources, creating a surface for indirect prompt injection.
  • Ingestion points: Ingests pull request metadata, bodies, and issue states via gh pr view and gh issue view as defined in SKILL.md.
  • Boundary markers: Absent. The instructions do not define delimiters or provide specific instructions to ignore embedded commands within the ingested GitHub data.
  • Capability inventory: The skill can execute powerful actions including gh pr merge, gh pr edit, gh issue close, and filesystem-related cleanup via bb environment archive-threads as defined in SKILL.md.
  • Sanitization: Absent. There is no evidence of validation or filtering for data retrieved from pull requests or issues before it is used in logic or reporting.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 3, 2026, 05:51 PM
Security Audit — agent-trust-hub — land-stack