triage
Warn
Audited by Gen Agent Trust Hub on Jul 12, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs the agent to "check out" and "run the relevant tests or commands" from external pull requests during verification. Executing code from untrusted sources is a high-risk activity that can facilitate arbitrary remote code execution.
- [COMMAND_EXECUTION]: The requirement to verify pull requests by running their associated tests or commands provides a direct path for executing malicious payloads provided by external contributors within the agent's environment.
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes untrusted data from issue trackers and pull requests without security boundaries.
- Ingestion points: Pull request bodies, comments, and code diffs are ingested into the context during the "Gather context" step in SKILL.md.
- Boundary markers: No explicit delimiters or instructions are provided to the model to differentiate between instructions and untrusted data content.
- Capability inventory: The skill possesses powerful capabilities including arbitrary command execution (testing PRs), file system writes (writing to the .out-of-scope/ directory), and network writes (posting comments and closing issues).
- Sanitization: There is no mention of sanitization or validation of external code or text before it is processed or executed.
Audit Metadata