managing-release-issue
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data by reading the body of existing GitHub issues using the
gh issue viewcommand. This content is then used to construct an updated version of the issue body. A malicious actor could embed instructions within an issue's description to influence the agent's behavior during the update process. - Ingestion points: The
gh issue viewcommand in the workflow (Step 2) retrieves thebodyfield of a GitHub issue. - Boundary markers: The instructions lack explicit delimiters or warnings to the agent to ignore any instructions found within the issue body.
- Capability inventory: The skill has the capability to modify repository content via the
gh issue editcommand (Step 4). - Sanitization: No sanitization or validation of the ingested issue body is performed before it is rewritten.
- [COMMAND_EXECUTION]: The skill uses the GitHub CLI (
gh) to perform read and write operations. While these are intended for releasing and tracking project progress, the workflow involves interpolating AI-generated content into a shell command using a heredoc (cat <<'BODY'). If the content is not handled correctly, it could lead to shell formatting issues, though the use of single quotes around the heredoc marker ('BODY') is a good practice that prevents variable expansion.
Audit Metadata