engram-backlog-triage
Pass
Audited by Gen Agent Trust Hub on Nov 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input from GitHub issue and PR titles, bodies, and comments to determine triage dispositions. A malicious actor could embed instructions in an issue to manipulate the agent into performing unauthorized actions.
- Ingestion points: Untrusted issue and PR metadata/content fetched via gh CLI in SKILL.md.
- Boundary markers: Absent; the instructions do not define delimiters to separate instructions from the data being analyzed.
- Capability inventory: The skill has the authority to execute gh pr merge, gh pr review --approve, and gh issue close/edit.
- Sanitization: Absent; there is no logic provided to sanitize or escape user-provided content before the agent evaluates it.
- [COMMAND_EXECUTION]: The skill uses the GitHub CLI to execute shell commands for repository management. While these are legitimate tools, the automation of commands like merge and close based on LLM interpretation of untrusted external content poses a risk of unintended repository modifications or command injection if repository identifiers are not strictly validated.
Audit Metadata