design-control-loop
Pass
Audited by Gen Agent Trust Hub on Jun 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill is designed to generate and deploy shell scripts (
references/agent-iteration.ts) and GitHub Action workflows (references/workflow-template.yml) into the user's repository. These generated components execute shell commands to interact with the repository, filesystem, and the GitHub API. - [REMOTE_CODE_EXECUTION]: The
references/agent-runner-templates.mdfile provides instructions for installing and executing several third-party CLI agents within a CI environment. - The templates include installation commands for packages such as
@anthropic-ai/claude-code,@openai/codex,opencode-ai, and@humanlayer/cli. - These agents are often configured with high-privilege flags like
--permission-mode bypassPermissionsand--sandbox danger-full-access, granting the AI agent broad execution capabilities on the CI runner. - [PROMPT_INJECTION]: The Pull Request iteration mechanism implemented in
references/agent-iteration.tscreates an indirect prompt injection surface. - Ingestion points: The script uses the GitHub CLI (
gh api) to retrieve the content of PR bodies and all associated comments (issue and review comments). - Boundary markers: The retrieved data is interpolated into the agent's prompt under markdown headers (e.g., '# PR Issue Comments'). While structured, there are no explicit 'ignore instructions' guards to prevent the agent from following malicious commands embedded in comments by external contributors.
- Capability inventory: The agent processing this untrusted data has full shell access and repository write permissions within the CI runner environment.
- Sanitization: The script does not perform sanitization, filtering, or escaping of the user-provided comment text before it is sent to the LLM.
Audit Metadata