triage
Pass
Audited by Gen Agent Trust Hub on Jul 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides the agent with the capability to execute shell commands. In SKILL.md, under the 'Reproduce (bugs only)' section, the agent is explicitly directed to 'run tests or commands' derived from the reporter's steps.
- [PROMPT_INJECTION]: An indirect prompt injection vulnerability exists because the skill processes untrusted input and uses it to perform sensitive operations.
- Ingestion points: Untrusted data enters the agent context in SKILL.md (Triage a specific issue, Step 1) when the agent reads the full issue body, comments, and reporter details.
- Boundary markers: There are no explicit instructions or delimiters used to separate the untrusted reporter input from the agent's core instructions, nor are there warnings to ignore commands embedded in the issue text.
- Capability inventory: The agent has significant capabilities, including running shell commands, executing tests, and reading/writing to the local file system (SKILL.md, OUT-OF-SCOPE.md).
- Sanitization: The instructions do not require any validation or sanitization of the reproduction steps or commands provided by the external reporter before they are executed.
Audit Metadata