security-alert-triage
Pass
Audited by Gen Agent Trust Hub on Nov 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources including GitHub security alerts and repository file contents, which presents a surface for indirect prompt injection. This could allow an attacker to craft a malicious alert or code comment designed to trick the agent into recommending the dismissal of a real vulnerability.
- Ingestion points: The skill fetches potentially attacker-controlled data via
list_code_scanning_alerts,list_dependabot_alerts,list_secret_scanning_alerts, andget_file_contents(SKILL.md, Steps 1, 4, 5). - Boundary markers: No specific delimiters or instructions to ignore embedded commands within the alert descriptions or code snippets are provided to the agent.
- Capability inventory: The skill possesses the ability to read sensitive vulnerability data and source code. It does not have the ability to execute shell commands, perform network requests to non-whitelisted domains, or modify repository state (e.g., no tool to dismiss alerts or merge code).
- Sanitization: There is no evidence of sanitization or validation of the text retrieved from GitHub alerts before it is processed by the agent for analysis.
Audit Metadata