autopilot-interview
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data such as plans, PRDs, and repository files to generate interview questions, creating a vulnerability surface for embedded instructions.\n
- Ingestion points: The
SKILL.mdfile directs the agent to load content from conversation history, repository files, issues, and PRDs.\n - Boundary markers: The instructions lack explicit delimiters or warnings to ignore instructions found within the processed plans.\n
- Capability inventory: The skill can execute local Node.js scripts, write to the filesystem, and modify local repository configuration.\n
- Sanitization: No sanitization or escaping mechanisms are defined for the untrusted plan data.\n- [COMMAND_EXECUTION]: The skill requires the execution of a bundled initialization script to set up the workflow environment.\n
- Evidence:
SKILL.mdinvokesnode <this-skill-dir>/scripts/new-autopilot-interview-run.mjs. While the script is local to the skill package, this pattern grants the agent command execution authority within the workspace context. The script specifically modifies the repository's local Git metadata by appending exclusion patterns to.git/info/exclude.
Audit Metadata