triage
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted GitHub issue data, comments, and cited repository content which presents an indirect prompt injection surface.
- Ingestion points: Fetches GitHub issue content, including titles, bodies, comments, and external git logs/excerpts in
SKILL.md. - Boundary markers: Implements strict data isolation by requiring all untrusted content-bearing artifacts to be enclosed via
untrusted file-blockoruntrusted content-blockformatting wrappers. - Capability inventory: Possesses capability to execute localized scripts via
larch.sh, invoke child sub-skills like/block-issueor/issue, and run specific testing viatriage probe. - Sanitization: Mandates the neutralization of user-controlled markdown comment injection patterns (
<!-- larch:) and actively redacts sensitive items (secrets, operator paths, internal URLs) before output or mutation.
Audit Metadata