investigating-design-rationale
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a Node.js utility script (
shared/scripts/fetch-pr-feedback.mjs) that executes the GitHub CLI (gh). The script implements robust security controls, including strict regular expression validation for all command-line arguments (PR numbers, URLs, and hostnames) to prevent shell command injection. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted prose from external sources like pull request bodies, comments, and issue tickets. This creates a potential indirect prompt injection surface. The skill addresses this risk with explicit instructions in
SKILL.mdand a dedicatedshared/external-data.mdpolicy, which mandates treating historical evidence as data (never instructions), using boundary markers, and avoiding the interpolation of untrusted text into command arguments. - [EXTERNAL_DOWNLOADS]: The skill fetches pull request metadata and discussion history from GitHub. These network operations are performed via the
ghtool targeting a well-known service and are restricted to the specific repository context provided by the user.
Audit Metadata