triage
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from an external issue tracker, including issue bodies, comments, and pull request diffs (Step 1). It lacks explicit boundary markers or sanitization logic to distinguish between instructions and data, creating a surface where malicious text in an issue could influence agent behavior.
- Ingestion points: Issue bodies, PR bodies, comments, and diffs (SKILL.md).
- Boundary markers: Not specified for external content processing.
- Capability inventory: Shell command execution for tests (Step 3), file system writes for out-of-scope tracking (Step 5), and commenting on the issue tracker.
- Sanitization: Not specified for external data interpolation.
- [DYNAMIC_EXECUTION]: The skill is instructed to "run the relevant tests or commands" to verify bug reports or pull request claims (Step 3). This involves executing code that may be modified or provided by untrusted external contributors in a PR, potentially leading to the execution of malicious logic within the agent's environment.
- [COMMAND_EXECUTION]: The skill uses shell commands to interact with the repository, including checking out code branches and running project-specific testing tools to verify submitted changes.
Audit Metadata