implement
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to recursively discover and follow instructions in
AGENTS.mdandAGENTS.local.mdfiles within the target repository. This creates a vulnerability where an attacker could place malicious instructions in a codebase to manipulate the agent's behavior. Additionally, the skill processes all comments in an issue tracker to define its work contract, which could allow third parties to inject instructions via the tracker.\n - Ingestion points:
AGENTS.md,AGENTS.local.md, and issue tracker comments in the repository's tracker.\n - Boundary markers: None. The skill does not utilize delimiters to separate its own logic from instructions found in the data.\n
- Capability inventory: File writing, Git operations (commit, push, merge), and execution of development tools (
ticket-queue,herdr).\n - Sanitization: No sanitization of the input instructions is performed.\n- [COMMAND_EXECUTION]: The skill performs sensitive Git operations, including merging branches and pushing code to remote repositories. It also executes local CLI tools such as
ticket-queueand sub-commands within theSkilltool interface (tdd,code-review,herdr). While these are aligned with the skill's purpose, they represent a significant capability tier that could be abused if the agent is compromised by malicious instructions.
Audit Metadata