augur
Warn
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill's core functionality relies on generating and running arbitrary code at runtime. As described in Step 5 and the 'references/proof.md' file, the agent is instructed to write custom scripts to a temporary directory (
/tmp/augur-[UID]) and execute them using the project's local toolchain (e.g., Node.js, Python, Ruby, or Rust). This mechanism is used to 'prove' the safety of code changes by importing and calling the project's own modules. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data, including pull request titles, body descriptions, and commit subjects. There are no explicit boundary markers or sanitization steps defined for how the agent should handle these inputs. Maliciously crafted PR descriptions or code comments could potentially influence the agent's logic during the script generation phase, leading to the creation of proving scripts that perform unintended actions.
- [COMMAND_EXECUTION]: The skill utilizes several shell commands to interact with the repository and GitHub. It uses
gh pr view,gh pr diff,git fetch,git show, andgit diffto inspect changes. It also uses a specific Bash routine to securely create and verify ownership of a temporary scratch directory before script execution.
Audit Metadata