ensure-story-github-issue
Pass
Audited by Gen Agent Trust Hub on Nov 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-controllable story markdown files and interpolates extracted fields (such as titles and acceptance criteria) into unquoted shell heredocs (
<<EOF) and command arguments. This creates an attack surface where a malicious document could trigger command substitution (e.g., using backticks or$(...)) during the agent's execution of the shell blocks. - Ingestion points: The skill reads metadata and text content from the file path defined in
STORY_FILE_PATH. - Boundary markers: No explicit delimiters or boundary markers are employed to isolate the untrusted document content from the shell script logic.
- Capability inventory: The agent has access to powerful tools, including the
ghCLI (network and repository management),node, and general shell command execution. - Sanitization: No sanitization or escaping of the extracted text is performed before interpolation. The skill's own documentation acknowledges the 'residual risk' of command substitution in unquoted heredocs.
Audit Metadata