triage
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from external sources (GitHub issue bodies, comments, and reporter-provided reproduction steps) which could contain malicious instructions.
- Ingestion points: The agent reads issue context, comments, and specific reporter steps in
SKILL.mdduring the 'Gather context' and 'Reproduce' phases. - Boundary markers: The instructions do not define explicit boundary markers or warnings to the model to ignore instructions embedded within the issue data.
- Capability inventory: The skill allows for command and test execution (
SKILL.md), file system writes (OUT-OF-SCOPE.md), and network operations through GitHub API interactions (posting comments and applying labels). - Sanitization: There is no evidence of sanitization, validation, or escaping of the external issue content before it is processed or used to drive code execution.
- [COMMAND_EXECUTION]: The skill explicitly instructs the agent to perform reproduction of reported bugs by tracing code and running tests or commands based on the reporter's instructions in
SKILL.md. While this is a core functionality for a triage agent, it provides a mechanism for executing arbitrary logic if the input is not carefully scrutinized by the model or restricted by the environment.
Audit Metadata