harness-triage
Pass
Audited by Gen Agent Trust Hub on Jun 14, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes untrusted data from external sources (GitHub issue bodies and comments).
- Ingestion points: As described in
SKILL.md, the agent reads full issue bodies, comments, and existing labels to gather context. - Boundary markers: There are no explicit instructions to use delimiters (e.g., XML tags or triple backticks) to isolate untrusted issue content from the agent's instructions during processing.
- Capability inventory: The agent has the ability to post comments, label issues, close issues, update project board metadata (Effort, Size, Priority), and create/modify files in the
.out-of-scope/directory. - Sanitization: No specific sanitization or filtering of the ingested issue text is performed to prevent embedded instructions from influencing agent behavior.
- Mitigation: The risk is mitigated by the instruction logic which requires the agent to 'Recommend' and then 'Wait for direction' from the maintainer before applying any state changes or labels. Additionally, project board updates for Priority are explicitly gated behind a maintainer query.
Audit Metadata