request-refactor-plan
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill identifies a workflow where untrusted repository content is used to inform agent actions and generate external outputs, presenting an indirect prompt injection surface. \n- Ingestion points: The skill directs the agent to "Explore the repo to verify their assertions and understand the current state of the codebase" (Step 2). \n- Boundary markers: The instructions lack boundary markers or specific guidance for the agent to ignore instructions that might be found within the code or comments of the repository being analyzed. \n- Capability inventory: The skill has the capability to create GitHub issues (Step 8) and specifically feeds results back into the /execute skill for implementation, which could allow malicious instructions in the code to influence external actions or subsequent tool invocations. \n- Sanitization: There is no mention of sanitizing or validating the content extracted from the repository before it is used to populate the GitHub issue template or passed to the execution phase.
Audit Metadata