do-execute-qa-fix
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external data from bug reports and project documentation to drive autonomous code changes and command execution. An attacker could potentially embed malicious instructions in a bug report file to manipulate the agent's behavior.
- Ingestion points: Reads bug report markdown files (e.g.,
qa/qa-1/bugs/bug-01.md), PRDs, technical specifications, and project-level instruction files (e.g.,CLAUDE.md,AGENTS.md). - Boundary markers: The skill does not define specific delimiters or instructions to ignore embedded commands within the ingested data.
- Capability inventory: Possesses capabilities to read/write files within the project root, execute shell commands (test suites, static checks), and utilize MCP tools for UI and service testing.
- Sanitization: No explicit sanitization or validation of the input data is performed before implementing the proposed fix.
- Autonomy Abuse: The skill's policy strictly prohibits pausing for user input during execution, which removes the human-in-the-loop safety check for potential malicious instructions encountered in the data.
- [COMMAND_EXECUTION]: The skill dynamically resolves and executes project-specific commands for running test suites and static analysis tools. This involves executing code that resides within the project repository as part of the validation process.
Audit Metadata