kata-check-issues
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from GitHub issue titles and bodies which are then processed by the agent and interpolated into shell scripts and planning documents. This creates an indirect prompt injection surface where malicious data could influence agent actions or downstream processing.\n
- Ingestion points: GitHub issue data retrieved via
gh issue listandgh issue viewcommands in SKILL.md, and local planning files in.planning/issues/.\n - Boundary markers: The skill lacks explicit boundary markers or 'ignore embedded instructions' warnings when processing this external content in the shell blocks.\n
- Capability inventory: The skill possesses significant capabilities including file system modification (
mv,mkdir,cat), version control operations (git add,git commit), and network interaction via the GitHub CLI (gh).\n - Sanitization: While basic sanitization is performed for filenames (slugging), the issue titles and bodies are used without adequate escaping in shell heredocs and command substitutions.\n- [COMMAND_EXECUTION]: Several process steps involve constructing shell commands using variables containing GitHub issue content. Specifically, the
execute_actionstep uses unquoted heredocs (cat << EOF) and command substitutions ($(...)) to handle${TITLE}and${BODY}. This pattern is vulnerable to shell injection if the content contains specific shell metacharacters or the heredoc delimiter, potentially leading to unintended command execution within the agent's environment.
Audit Metadata