issue-import-from-md
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- Indirect Prompt Injection Surface: The skill processes markdown files that may be generated by external scanners or third parties. It includes explicit instructions to treat this content as data to prevent embedded instructions from overriding agent behavior.
- Shell Injection Prevention: To safely handle attacker-controlled fields like issue titles, the skill uses temporary files and character allowlists when calling external tools like the GitHub CLI, adhering to security best practices.
- Local Tooling and Framework Integration: The skill utilizes local framework components for pre-flight and privacy checks. These operations are consistent with the intended functionality and infrastructure provided by the vendor.
- Data Privacy Handling: A privacy check is mandated before parsing findings to identify potential personally identifiable information (PII), ensuring that sensitive data is handled according to security protocols.
Audit Metadata