cr
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from GitHub PR comments to guide code modifications. A malicious actor could craft a comment that tricks the AI into injecting backdoors or performing unauthorized file operations. While the instructions advise the agent to use judgement, there are no technical sanitization measures.\n
- Ingestion points: GitHub API responses fetched via
gh apiinSKILL.md(Step 2).\n - Boundary markers: Absent. The fetched content is not wrapped in protective delimiters.\n
- Capability inventory: File system read/write access (Step 5) and
ghcommand execution (Steps 1 & 2).\n - Sanitization: Absent. No filtering or escaping is applied to the comment body before the agent evaluates it.\n- [COMMAND_EXECUTION]: The skill uses shell commands (
gh,git,jq) to perform its tasks. The inclusion of user-provided arguments in shell scripts (e.g., the PR number) is a potential surface for command injection if the execution environment does not adequately sanitize inputs.
Audit Metadata