design-to-issues
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from a markdown design document to create and update GitHub Issues and milestones. \n
- Ingestion points: The skill reads a
<design-doc>file usingscripts/story_contract.pyto generate a manifest. \n - Boundary markers: The skill uses and validates specific HTML-style markers (
<!-- feature-delivery:... -->) to identify its managed content. Bothscripts/story_contract.pyandscripts/render_issue_body.pycontain explicit checks to reject input that contains these reserved markers, preventing attackers from spoofing management metadata. \n - Capability inventory: The skill uses the GitHub CLI (
gh) to create and update issues and milestones, and performs file-write operations to temporary manifest files. \n - Sanitization: The Python scripts perform markdown normalization and validate the structural integrity of user stories (e.g., requiring specific headings and dependency formats).
scripts/story_contract.pyalso validates that the design document resides within the repository root to prevent path traversal. \n- [COMMAND_EXECUTION]: The skill executes several bundled shell and Python scripts (scripts/create_issue.sh,scripts/create_milestone.sh, etc.) to perform its tasks. The shell scripts utilize the GitHub CLI for remote operations. These scripts use proper quoting for variables to mitigate common shell injection risks, and the Python scripts use deterministic parsing rather than dynamic execution.
Audit Metadata