issue
Pass
Audited by Gen Agent Trust Hub on May 20, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the 'git' and 'gh' command-line tools to identify the current repository and create issues. Specifically, it executes 'git remote get-url' to extract the repository path and 'gh issue create' to submit the finalized design documentation to GitHub.
- [DATA_EXPOSURE]: To provide accurate design suggestions, the skill instructs the agent to read and analyze the local codebase, including models, routes, and configuration files. This data access is aligned with the skill's purpose as a development assistant.
- [INDIRECT_PROMPT_INJECTION]: The design documentation is generated based on user input and subsequently passed as a string argument ('--body') to the 'gh' shell command. While this represents a surface for command injection, the instruction mandates that the agent display the full body to the user and obtain permission before proceeding, providing a human-in-the-loop security checkpoint.
Audit Metadata