ce-promote
Warn
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions specify running the
spiral write "<prompt>"command where the prompt includes data derived fromgh pr viewandgit diff. This creates a shell command injection surface if the PR title, body, or diff contains characters such as backticks, semicolons, or subshell syntax, as the agent is not explicitly directed to sanitize these inputs before shell interpolation. - [REMOTE_CODE_EXECUTION]: The setup flow utilizes
npx @every-env/spiral-cli@latest setupto install and configure the necessary tooling. This command downloads and executes code from the npm registry at runtime. - [PROMPT_INJECTION]: The skill derives its drafting context from external, untrusted sources within the repository, including PR descriptions, commit messages, and diffs. This data is interpolated into LLM prompts without sanitization or boundary markers, exposing the skill to indirect prompt injection that could alter the generated drafts.
- [DATA_EXFILTRATION]: Repository information such as PR details and code diffs are transmitted to the external service at
app.writewithspiral.comvia the vendor-provided Spiral CLI to generate brand-voice matched copy.
Audit Metadata