execute-linear-epic-with-codex
Pass
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection vulnerability surface because it is designed to ingest and act upon data from external sources that can be controlled by third parties.
- Ingestion points: The skill fetches PR comments and reactions using
gh pr view --commentsand the GitHub API (gh api repos/{owner}/{repo}/pulls/<number>/comments) as defined inSKILL.md. - Boundary markers: None. There are no instructions to the agent or the Codex plugin to treat the fetched PR content as untrusted data or to ignore instructions embedded within the feedback.
- Capability inventory: The skill has the capability to modify repository code (via the Codex plugin), execute arbitrary shell commands (by running discovered package scripts and repository checks), and perform git operations like pushing and merging.
- Sanitization: Absent. The instructions mandate the reproduction of "every actionable claim" from the comments without filtering or validating the content for malicious instructions.
- [COMMAND_EXECUTION]: The skill performs dynamic execution of local repository code.
- It is instructed to inspect the repository for "package scripts" and "CI checks" and execute the "smallest relevant checks discovered from repository conventions."
- While this is typical for developer tools, it allows for the execution of code found within the repository which may not have been explicitly authored by the user.
Audit Metadata