oss-contributor
Pass
Audited by Gen Agent Trust Hub on Nov 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill directs the agent to read and interpret instructions from external, untrusted sources such as GitHub issue comments, PR templates, and
CONTRIBUTING.mdfiles. Malicious actors could embed instructions in these locations to attempt to manipulate the agent's behavior. - Ingestion points: External files like
CONTRIBUTING.md, issue templates, and existing issue comments found in open-source repositories (Phase 1 and Phase 2). - Boundary markers: Absent. The skill does not instruct the agent to treat external content as data only or provide specific delimiters to prevent command leakage.
- Capability inventory: The agent has the capability to write files, commit code, and perform network operations via GitHub (Phase 5).
- Sanitization: Absent. There is no requirement for the agent to sanitize or filter out potential instructions found in external comments or documentation.
- [DYNAMIC_EXECUTION]: To fulfill its purpose, the skill requires the agent to execute build and test scripts found within the target repository. This constitutes execution of external, potentially unverified code.
- Evidence: Phase 4 instructs the agent to "Run the repo's own checks for the touched area" and "add tests in the repo's existing test style." This involves running arbitrary code provided by the repository being contributed to.
Audit Metadata