why
Pass
Audited by Gen Agent Trust Hub on Nov 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection attack surface because it retrieves and processes content from potentially attacker-controlled sources (such as GitHub PR comments, Linear tickets, or Slack messages) and interpolates this content into agent prompts.
- Ingestion points: Content is pulled from git, gh, Linear, Notion, Slack, Datadog, Sentry, and Databricks via references/investigator-prompt.md.
- Boundary markers: The skill uses basic markdown quoting and block formatting in its prompt templates to separate instructions from external data.
- Capability inventory: The investigators have the ability to execute shell commands (git, gh) and call various MCP tools for external service access.
- Sanitization: There is no evidence of content sanitization or escaping before external data is provided to the LLM.
- [COMMAND_EXECUTION]: The skill utilizes shell commands such as git blame, git log, git show, and gh pr view to gather historical information from the repository. While these are standard development tools and the skill instructions restrict agents from writing files, these commands allow the agent to interact with the local environment and source control.
Audit Metadata