bug-triage
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEDYNAMIC_CONTEXT_INJECTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_CONTEXT_INJECTION]: The skill employs the
!syntax to execute a shell command (bash "${CLAUDE_SKILL_DIR}/../../hooks/yaml-helper.sh" resolve_config --keys automation) at load time. This mechanism is used to populate the agent's context with configuration data from a local helper script before the instructions are processed.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from multiple sources, creating a potential vector for indirect prompt injection.\n - Ingestion points: The skill reads bug reports from
production/qa/bugs/*.md,production/qa/bugs.md, andproduction/qa/qa-plan-*.mdas specified in Step 2a.\n - Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are used when reading bug bodies for re-evaluation.\n
- Capability inventory: The skill has access to
Write,Edit, andBashtools (the latter being scoped to a specific configuration script), allowing it to modify project files based on the ingested content.\n - Sanitization: There is no evidence of sanitization or validation of the content retrieved from the bug files.\n- [COMMAND_EXECUTION]: The skill utilizes the
Greptool with defined patterns and theBashtool restricted to a specific utility script (yaml-helper.sh) to perform configuration and data extraction tasks.
Audit Metadata