triage
Warn
Audited by Gen Agent Trust Hub on May 15, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to "run tests or commands" based on a reporter's steps during bug reproduction (found in
SKILL.md). This allows for arbitrary command execution on the host machine if the agent follows malicious instructions provided by an external user in a GitHub issue. - [PROMPT_INJECTION]: The skill is highly vulnerable to indirect prompt injection as it ingests and processes untrusted data from GitHub issue bodies and comments.
- Ingestion points: Data enters the system context through GitHub issue bodies, comments, and local markdown files passed to the triage command.
- Boundary markers: There are no explicit markers or instructions to isolate untrusted content or warn the agent to ignore embedded commands within issue data.
- Capability inventory: The skill uses the
ghCLI for repository management and explicitly grants the capability to execute shell commands and tests as part of the triage process. - Sanitization: There is no evidence of command sanitization, input validation, or filtering of the content retrieved from external sources before it is used to drive the reproduction process.
Audit Metadata