review-discussions-cx
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted user-generated content from GitHub Discussions. If a discussion contains malicious instructions, the agent might attempt to follow them when drafting summaries or responses.
- Ingestion points:
SKILL.md(Step 2) usesWebFetchto ingest full content and comments from GitHub Discussion pages. - Boundary markers: The instructions lack explicit delimiters or warnings to ignore instructions found within the discussion text.
- Capability inventory: The skill uses
browser_subagent(Steps 5 and 6) to post comments and create new GitHub issues. - Sanitization: No sanitization or validation of the fetched discussion content is described before it is processed by the agent.
- Mitigation: The skill implements a mandatory human-in-the-loop requirement, stating that no actions should be taken until the user explicitly approves the summary report.
Audit Metadata