bento-ship
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from multiple sources to guide its high-capability workflow (Steps 2, 3, and 13).
- Ingestion points: Repository files such as
AGENTS.md,CLAUDE.md, and.agents/bento/bento-ship.md, as well as ticket IDs/descriptions and PR bodies. - Boundary markers: Absent; there are no instructions to wrap or delimit this external data to prevent it from being interpreted as instructions.
- Capability inventory: The skill can perform git commits, pushes (including force-pushes), create/update PRs via the GitHub CLI, and update external ticketing systems via MCP or CLI tools (Steps 9, 12, 13, 14).
- Sanitization: Absent; the skill directly uses extracted ticket titles and bodies to populate PR fields.
- [COMMAND_EXECUTION]: The skill dynamically discovers and executes build, test, and linting commands from the local repository (Step 7). While this is necessary for its primary purpose, it allows a malicious repository to trigger arbitrary code execution during the automated shipping process.
Audit Metadata