mission-control
Pass
Audited by Gen Agent Trust Hub on Apr 8, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill contains an indirect prompt injection surface. It uses a webhook transform (assets/transforms/github-mission-control.mjs) to fetch tasks.json from a remote GitHub repository and interpolates task descriptions and comments into a 'work order' prompt that triggers the agent. If the repository is compromised or an attacker can influence task content, they could inject malicious instructions that the agent would then follow.
- Ingestion points: tasks.json content fetched via GitHub API in assets/transforms/github-mission-control.mjs.
- Boundary markers: The work order uses markdown headers like 'Aufgabe:' but lacks explicit instructions for the agent to ignore or isolate potentially malicious embedded instructions.
- Capability inventory: The agent has the ability to execute shell commands and git operations via scripts/mc-update.sh.
- Sanitization: There is no evidence of sanitization, filtering, or escaping applied to the remote task content before it is interpolated into the agent prompt.
- [EXTERNAL_DOWNLOADS]: The documentation suggests downloading and executing a script from an external source as part of the setup process.
- Evidence: docs/PREREQUISITES.md contains the command 'curl -fsSL https://tailscale.com/install.sh | sh'.
- Context: This download targets Tailscale, which is a well-known service, and serves a legitimate purpose for the skill's infrastructure requirements. Per the trust-scope rule, this does not contribute to verdict escalation.
Audit Metadata