build-iterated-agentic-loop
Warn
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTIONCREDENTIALS_UNSAFEDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill generates GitHub Actions workflows that execute shell commands and high-privilege CLI tools.
- The helper script
references/agent-iteration.tsuses shell interpolation with the GitHub CLI (gh) to fetch pull request data. - Generated workflows utilize flags such as
--permission-mode bypassPermissions,--sandbox danger-full-access, and--dangerously-skip-permissionsto allow agents to operate autonomously in CI runners. - The workflow template uses user-contributed comment bodies as command-line arguments for the iteration script, which represents a potential command injection risk, although this is restricted to repository members.
- [EXTERNAL_DOWNLOADS]: The skill templates perform global installation of various coding agent packages from external registries.
- Downloads include
@anthropic-ai/claude-code,@openai/codex,opencode-ai, and@humanlayer/clifrom NPM and Bun registries. - Standard GitHub Actions are used for environment setup, including
actions/checkoutandoven-sh/setup-bun. - [PROMPT_INJECTION]: An indirect prompt injection surface exists in the iteration workflow where untrusted data is processed.
- Ingestion points: The
references/agent-iteration.tsscript fetches issue comments and review comments from the GitHub API. - Boundary markers: The generated prompt uses Markdown headers (e.g., '# PR Issue Comments') to delineate the external data.
- Capability inventory: The configured coding agents are granted write permissions to repository contents and pull requests, and can execute shell commands within the CI runner.
- Sanitization: There is no evidence of sanitization or filtering of the external comments before they are interpolated into the agent's prompt.
- [CREDENTIALS_UNSAFE]: The skill relies on sensitive API keys and tokens for operation.
- Workflows are configured to use
ANTHROPIC_API_KEY,OPENAI_API_KEY, andGITHUB_TOKEN. - These secrets are passed into the CI environment as environment variables for use by the coding agents.
- [DATA_EXFILTRATION]: The skill's primary function involves reading repository content and sending it to external AI service providers (Anthropic, OpenAI) for processing and code generation.
Audit Metadata