takeover
Pass
Audited by Gen Agent Trust Hub on Nov 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external, untrusted sources such as pull request descriptions, commit messages, and discussion threads, which could contain malicious instructions.
- Ingestion points: Section 1 ('Reconstruct the handoff') of
SKILL.mdinstructs the agent to read source PRs, threads, linked issues, reviews, and commits. - Boundary markers: The instructions include a heuristic safeguard, telling the agent to "Treat prior summaries and green checks as leads to verify" and to distinguish between "completed work from claims inherited but not independently verified."
- Capability inventory: The agent has the capability to write to the repository (commits, branch creation), create and watch pull requests, and use platform-specific tools like
t3_thread_readandlink_pull_request. - Sanitization: There is no explicit mention of data sanitization or escaping for the external content before it is processed by the agent.
Audit Metadata