stage-it
Pass
Audited by Gen Agent Trust Hub on Jul 27, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and follows instructions found in potentially untrusted repository files like
CONTRIBUTING.md,AGENTS.md, and runbooks to determine its workflow. - Ingestion points: Reads
AGENTS.md,CONTRIBUTING.md,.github/ISSUE_WORKFLOW.md, PR templates, and repository runbooks. - Boundary markers: No specific delimiters or "ignore instructions" wrappers are defined for the content read from these files.
- Capability inventory: The agent can create/merge PRs, perform git operations, and execute local shell commands (test suites and smoke checks).
- Sanitization: The instructions do not specify any validation or sanitization of the content retrieved from repository files before it is processed by the agent.
- [COMMAND_EXECUTION]: The skill executes local commands defined within the repository, such as "repo-standard gates from docs and package scripts" and "staging smoke checks from the repo runbook." While this is necessary for its core functionality, it grants the skill the ability to run arbitrary code provided by the repository being managed.
Audit Metadata