closing-obsolete-issues
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from external GitHub issues and comments, creating a vector for indirect prompt injection where an attacker could influence the agent's behavior through crafted issue text.
- Ingestion points: The
scripts/fetch_issue_details.shscript fetches issue descriptions and comments from theflutter/devtoolsrepository into the agent's context inSKILL.md(Instruction 2). - Boundary markers: The skill uses basic text headers such as "--- ALL COMMENTS ---" and "Description:" to separate fetched content, which are not robust against adversarial content meant to break out of data blocks.
- Capability inventory: The agent has the capability to modify the local
references/rationale_templates.mdfile and perform GitHub actions including posting comments and closing issues via theghCLI. - Sanitization: No explicit sanitization, filtering, or instruction to disregard embedded commands in external text is implemented.
Audit Metadata