surface-after-care
Pass
Audited by Gen Agent Trust Hub on Nov 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data and possesses significant operational capabilities, creating a surface for indirect prompt injection.
- Ingestion points: Untrusted data enters the agent context from repository files (README, manifests), external registry metadata (npm, PyPI), and community-submitted content (GitHub issues and pull requests) via commands like
cat,rg,npm view,gh issue list, andgh pr list. - Boundary markers: The instructions do not specify the use of delimiters or boundary markers to isolate external content from the agent's instructions.
- Capability inventory: The skill is authorized to perform file system modifications (
git commit), remote repository updates (git push), and repository management actions (gh repo edit,gh issue close,gh pr merge). - Sanitization: There are no explicit instructions for sanitizing or validating external input, allowing malicious content in files or issues to potentially influence the agent's downstream actions.
Audit Metadata