bento-learn
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources to update repository instructions, creating a potential vector for indirect prompt injection.
- Ingestion points: Pull request reviews are fetched via the GitHub CLI (gh api), and local session transcripts are read from the .claude or .codex directories using scripts/sessions.py.
- Boundary markers: No strict technical delimiters are used between external data and the agent's prompt context during the Reflect phase, though the skill provides guidance on sampling and verifying reviewer input.
- Capability inventory: The skill possesses the ability to read and write files within the project repository and execute shell commands via Git and the GitHub CLI.
- Sanitization: The skill mitigates risks by requiring the agent to paraphrase findings rather than copying raw dumps and by utilizing an automated validation script (scripts/check_entries.py) that strictly limits new instruction entries to a maximum of two lines, preventing the persistence of complex malicious payloads.
- [COMMAND_EXECUTION]: The utility scripts included with the skill execute shell commands to manage local environment interactions.
- Evidence: scripts/sessions.py uses subprocess.run to call Git for identifying repository boundaries and branch history.
- Context: These commands are scoped to repository metadata and are necessary for the skill's primary function of locating session transcripts within the local worktree.
Audit Metadata