implement-issue-tree
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from GitHub issue descriptions and pull request comments to automate implementation tasks. An attacker could attempt to inject malicious instructions into an issue body. The skill author has implemented multiple defensive layers:
- Ingestion points: The skill fetches issue sub-tasks, descriptions, and PR comments via the GitHub CLI (referenced in SKILL.md and tests/tree-completeness.test.mjs).
- Boundary markers: It uses unique session nonces (ensured by ensureBoundaryNonceSeed in tests/state-write-fallback.test.mjs) and isolation tags () to wrap external content.
- Capability inventory: The skill can perform git commits, pushes, and GitHub API calls (closing issues, managing PRs).
- Sanitization: It includes logic to sanitize input and validate expected data formats, and includes a bash hook (scripts/merge-guard-hook.sh) to prevent unauthorized merge operations by sub-agents, as detailed in references/out-of-scope-support.md.
Audit Metadata