readonly
Pass
Audited by Gen Agent Trust Hub on Nov 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes content from repositories, git history, and external web pages, creating a potential surface for indirect prompt injection.
- Ingestion points: The skill reads from the repository's codebase, git history, issues, PRs, and external web content via browser research as specified in the Read-only sources section.
- Boundary markers: No specific delimiters or safety instructions are defined to separate ingested content from the agent's internal instructions.
- Capability inventory: The skill utilizes read-only tools such as rg, find, cat, and git commands, along with gh CLI for remote queries. It explicitly bans all tools that modify state, including file editors, git mutation commands, and deployment tools.
- Sanitization: There is no evidence of sanitization or filtering of external data before it is processed by the agent.
Audit Metadata