reproduce-and-fix-issues
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFEPROMPT_INJECTIONREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted bug reports and triage data to drive reproduction steps and automated code fixes.\n
- Ingestion points: Untrusted content is ingested from Slack threads (
SOURCE_THREAD_TS) and external tracker issues linked in triage markers.\n - Boundary markers: The skill mandates "Hard safety rules" (Section 0) that prohibit Slack write actions for child workers (
SendSlackMessage,PostToSlack, etc.) and freeze source coordinates to prevent message redirection.\n - Capability inventory: The system can perform Git commits, open draft pull requests on GitHub, and drive target applications via UI automation adapters.\n
- Sanitization: The coordinator reviews all diffs for secrets and unrelated changes before committing. A human "rejection window" is enforced before fix implementation begins.\n- [DYNAMIC_EXECUTION]: The skill dynamically identifies and loads functional components based on configuration.\n
- Evidence: It invokes a specific skill defined by the
control.skill_nameconfiguration parameter to serve as the application control adapter (Section 5).\n- [COMMAND_EXECUTION]: The skill executes actions that drive a target application's UI and manage its lifecycle.\n - Evidence: The control adapter contract facilitates starting application revisions, driving UI controls (clicks, typing, keyboard input), and stopping processes.\n- [TIME_DELAYED_OR_CONDITIONAL_ATTACKS]: Workflow execution is gated by external triggers and observation periods.\n
- Evidence: The skill waits for specific "triage markers" (e.g.,
[benny:bug]) and enforces a delay (rejection window) before starting the fix phase to allow for human review and correction.
Audit Metadata