triage
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data from issue trackers, which may contain malicious instructions targeting the agent.
- Ingestion points: The skill reads the full content of issues and pull requests, including bodies, comments, and code diffs, as specified in the 'Triage a specific issue or PR' section of
SKILL.md. - Boundary markers: There are no explicit instructions or delimiters provided to the agent to help it isolate untrusted content from the skill's instructions.
- Capability inventory: The skill allows the agent to execute shell commands for bug reproduction and testing, write to the
.out-of-scope/directory, and post comments to the issue tracker via network APIs. - Sanitization: The instructions do not mention sanitizing or escaping the external content before it is processed or used to generate actions.
- [COMMAND_EXECUTION]: The skill directs the agent to 'reproduce [the bug] from the reporter's steps' and 'run the relevant tests or commands' to verify pull requests. This capability is a significant risk if the reproduction steps or test commands are manipulated by an attacker via the issue or PR content.
Audit Metadata