add-bug
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted user input and writes it directly into a code file (packages/bugs/api/[v].ts) without sanitization.
- Ingestion points: User-provided bug descriptions, titles, and version strings.
- Boundary markers: Absent; the skill does not instruct the agent to use delimiters or escape characters when inserting user content into the TypeScript template.
- Capability inventory: The agent is tasked with modifying project source code files.
- Sanitization: Absent; the skill lacks instructions for validating or cleaning the user input before it is added to the source file.
Audit Metadata