wizard
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is instructed to read various repository files to identify configuration needs, which could be a surface for indirect instructions.
- Ingestion points: Processes project files including
.env,.env.example,README.md,docker-compose.yml, and.github/workflows/*to determine configuration requirements. - Boundary markers: No specific delimiters or instruction-blocking markers are defined for these inputs.
- Capability inventory: The skill generates executable bash scripts capable of file writing (
write_env) and network operations via the GitHub CLI (set_secret). - Sanitization: The instructions explicitly require the agent to present the planned stages and values to the user for confirmation and modification before the script is authored.
- [COMMAND_EXECUTION]: The skill's primary purpose is the generation and subsequent execution of bash scripts (
chmod +x <script>) on the user's local machine. - [DATA_EXFILTRATION]: The generated scripts are designed to capture user-provided credentials and exfiltrate them to the user's own GitHub repository secrets using the
ghcommand-line tool. This is a legitimate and documented function of the skill for CI/CD setup.
Audit Metadata