combine-issues
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests issue titles and bodies from GitHub, which are untrusted external inputs. An attacker could craft an issue to influence the agent's logic for merging, closing, or rejecting issues. 1. Ingestion points: Issue data is read from JSON files fetched by larch.sh in both standard and OOS modes. 2. Boundary markers: The instructions lack explicit boundary markers or warnings to the agent to treat issue content as potentially adversarial data. 3. Capability inventory: The agent has access to the Bash tool to execute larch.sh (which can create, close, and block issues) and the Write tool to create new issue bodies. 4. Sanitization: Path sanitization is mentioned for specific sub-commands, but no general sanitization of issue content is described before it is processed or used in shell command arguments.
- [COMMAND_EXECUTION]: The skill frequently executes shell commands via the Bash tool, incorporating variables like combined titles derived from untrusted issue data, which creates a potential surface for command injection.
Audit Metadata