idea
Warn
Audited by Gen Agent Trust Hub on Aug 8, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting user-provided one-liners and using them to generate planning documents and GitHub issues. \n
- Ingestion points: The user-provided one-liner in Step 1 of
SKILL.mdis the primary ingestion point for untrusted data. \n - Boundary markers: The instructions lack explicit delimiters or warnings to the agent to ignore instructions embedded within the user input. \n
- Capability inventory: The skill utilizes shell script execution, Git, and the GitHub CLI. \n
- Sanitization: No validation or escaping of the user input is specified before it is processed or written to files. \n- [COMMAND_EXECUTION]: The skill executes the
.claude/skills/idea/file-idea.shscript with user-influenced arguments. \n - Evidence: In Step 5 of
SKILL.md, the command.claude/skills/idea/file-idea.sh --title \"<title>\"uses the inferred or user-edited title variable. If the agent fails to escape shell metacharacters in the title string before execution, it could lead to arbitrary command execution in the shell environment.
Audit Metadata