to-issues
Pass
Audited by Gen Agent Trust Hub on Jul 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted external data by fetching and reading the full body and comments of GitHub issues (Step 1). This ingestion point lacks explicit boundary markers or instructions to ignore embedded commands, creating a surface for indirect prompt injection. \n
- Ingestion points: SKILL.md Step 1 (fetching issue bodies and comments via issue references or URLs).\n
- Boundary markers: None identified in the prompt instructions.\n
- Capability inventory: The skill has capabilities to read/write to the issue tracker using
gh api(Step 5 and 6) and explore the local codebase (Step 2).\n - Sanitization: No sanitization or validation of the fetched issue content is performed before the agent processes it to draft slices or execute API commands.
- [COMMAND_EXECUTION]: The skill executes shell commands using the
ghCLI andgh apito create issues and wire dependencies (Step 6). While these operations are consistent with the skill's stated purpose, the use ofgh api -X POSTwith arguments derived from potentially untrusted issue content (Step 1) increases the impact of successful prompt injection.
Audit Metadata