fix-bug
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon data from external GitHub issues, creating a vulnerability surface for indirect prompt injection attacks.
- Ingestion points: Untrusted data enters the agent context via the
gh issue viewcommand (Step 1), which retrieves the title, body, and comments of a user-controllable GitHub issue. - Boundary markers: The instructions do not specify any boundary markers (e.g., XML tags or delimiters) to separate external data from system instructions, nor do they include warnings for the agent to ignore instructions embedded within the issue text.
- Capability inventory: The agent is granted capabilities to modify the filesystem, execute test suites via
pnpm test, and interact with remote repositories usinggitandghCLI tools. - Sanitization: No sanitization, validation, or filtering mechanisms are described for the external content before the agent proceeds to the planning and implementation phases.
Audit Metadata