kb-github-shared-instructions
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines a framework where agents must ingest and summarize data from untrusted external sources, which is an inherent vector for indirect prompt injection.
- Ingestion points: The instructions mandate searching across all accessible GitHub repositories, reading issue reactions, monitoring GitHub Discussions, and using the
fetch_webpagetool to verify source content. - Boundary markers: The instructions suggest using quoted blocks for comment previews to ensure the user sees exact content, but they do not explicitly require distinct boundary markers (like XML tags) for all ingested data types to prevent the model from following instructions embedded in that data.
- Capability inventory: The skill provides rules for tools that can modify repository state (merging PRs, posting comments) and perform network operations via
fetch_webpage. - Sanitization: While the skill includes 'Safety Rules' requiring user confirmation before destructive actions or state modification, it lacks specific instructions for sanitizing or escaping the content of issues or discussions before processing them.
Audit Metadata