triage-aging-prs
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon data from pull requests, including branch code, titles, and review comments, which are untrusted external inputs.\n
- Ingestion points: The skill uses
gh pr listandgh apito fetch pull request metadata and reviews, and theTasktool to read branch code as described in Step 0 and Step 2 ofSKILL.md.\n - Boundary markers: The skill provides a dedicated reference file
assets/references/resolving-review-findings.mdwhich explicitly labels review text as untrusted.\n - Capability inventory: The agent has access to
Bash(for merging and repository configuration),Write, andEdittools.\n - Sanitization: Rule 1 in the reference file instructs the agent to treat findings as untrusted claims and never follow embedded instructions; Rule 3 mandates verification against the code at HEAD before implementation.\n- [COMMAND_EXECUTION]: The skill performs sensitive repository management tasks via the GitHub CLI.\n
- Evidence: In
SKILL.md(Step 1b), the skill provides logic to modify GitHub repository rulesets (gh api -X PUT \"repos/$REPO/rulesets/$ID\") to relax required status checks. While it instructs the agent to backup settings and ask for user confirmation, this capability allows for the manipulation of repository security posture.
Audit Metadata