triage
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection by ingesting and parsing untrusted data from GitHub issues to drive its internal state machine.
- Ingestion points: The skill reads the full body, comments, and labels of issues to collect context and parse existing triage notes (documented in
SKILL.md). - Boundary markers: There are no explicit instructions or delimiters defined to separate ingested user content from the agent's core instructions, increasing the risk that embedded commands in comments could influence the agent's decisions.
- Capability inventory: The skill has the capability to post comments, update issue labels/status, close issues, and write persistent records to the
.out-of-scope/directory (documented inSKILL.mdandOUT-OF-SCOPE.md). - Sanitization: The instructions do not specify any validation or sanitization of the issue content before the agent uses it to suggest roles or determine state transitions.
Audit Metadata