ps-why
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides numerous templates for shell commands (git, gh) and SQL queries (Databricks) that incorporate dynamically discovered or user-provided parameters like file paths, line ranges, PR numbers, symbols, and regex patterns. For example,
git blame -L <start>,<end> <file>andgit log -G '<regex>' -- <file>are used. If these inputs are not properly sanitized by the underlying agent platform, they present a surface area for command injection. - [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and synthesize data from a wide array of potentially untrusted external sources, creating a significant attack surface for indirect prompt injection.
- Ingestion points: The skill reads data from source control (PR comments), issue trackers (tickets/comments in Linear/Jira), long-form documents (Notion/Confluence), real-time chat (Slack/Discord), and infrastructure logs (Sentry/Datadog).
- Boundary markers: While the
investigator-prompt.mdandsynthesizer-prompt.mdtemplates use structured markdown sections to organize information, they lack explicit boundary markers or instructions to treat evidence content as untrusted data to avoid subagent hijacking. - Capability inventory: The skill utilizes
git,gh, and various read-only MCP tools to fetch data. The synthesizer subagent is granted broader 'agent mode' access to verify citations. - Sanitization: The instructions focus on accuracy and citation (epistemics) but do not describe mechanisms for sanitizing or escaping the content of the ingested evidence before it is processed by the AI subagents.
Audit Metadata