forgejo-api
Pass
Audited by Gen Agent Trust Hub on Nov 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill requires the agent to read and process data from external Forgejo instances, which could contain malicious instructions embedded by third parties.\n
- Ingestion points: The agent fetches potentially untrusted content from CI logs (e.g.,
GET .../actions/jobs/{job_id}/logs), issue bodies, and repository files.\n - Boundary markers: The instructions do not provide delimiters or warnings to the agent to help it distinguish between its primary task and instructions that might be contained within the retrieved data.\n
- Capability inventory: The skill documents powerful capabilities including file writing, secret management, and workflow dispatching, which could be abused if the agent is successfully manipulated via injection.\n
- Sanitization: Although the skill suggests using
jqto safely build outgoing JSON payloads, there is no process mentioned for sanitizing or filtering the content ingested from the Forgejo instance.
Audit Metadata