implement-issue
Pass
Audited by Gen Agent Trust Hub on May 18, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection via the processing of untrusted user-controlled data.
- Ingestion points: Data enters via GitHub issue titles, bodies, and comments fetched through GraphQL and REST APIs (SKILL.md, Steps 2 and 3).
- Boundary markers: The skill does not implement delimiters or explicit instructions to ignore embedded commands within the issue content.
- Capability inventory: The agent has capabilities for shell execution (gh, bun, git), file system access, and network operations (opening PRs).
- Sanitization: No sanitization or safety checks are applied to the external issue content before it influences the agent's behavior.
- [COMMAND_EXECUTION]: In Step 5 of the instructions, the agent is directed to "fetch and run that exact artifact" or reproduction command cited in an external issue body. This grants arbitrary command execution access to untrusted input provided by external GitHub users.
- [EXTERNAL_DOWNLOADS]: The workflow involves fetching external artifacts (such as Playwright runs or test262 artifacts) referenced in GitHub issues. As these sources are user-controlled and not restricted to a trusted vendor list, they pose a risk of delivering malicious payloads.
Audit Metadata