loop
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to autonomously process data from external, potentially untrusted sources such as pull request comments and CI logs.
- Ingestion points: The instructions in
SKILL.mddirect the agent to re-read transcripts, fetch unresolved review threads/comments, and pull failing CI job logs to diagnose issues. - Capability inventory: The agent is authorized to address feedback by addressing comments, fixing code, and performing SCM operations such as pushing changes and resolving threads via GraphQL mutations.
- Boundary markers: The instructions lack explicit delimitation or 'ignore instructions' warnings to prevent the agent from mistaking text within a comment for an authoritative command.
- Sanitization: There is no mention of sanitizing or validating the content of external comments before the agent acts upon them, creating a surface where a malicious comment could trigger unintended agent actions.
Audit Metadata