gh-oss-release-prep
Warn
Audited by Gen Agent Trust Hub on Mar 26, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute linter and test commands based on the project structure. It specifically directs the agent to check 'package.json' scripts for lint commands and run them, which constitutes execution of arbitrary scripts from the repository being analyzed.
- [DATA_EXFILTRATION]: The workflow involves exploring sibling directories using 'ls ../' to find other repositories belonging to the user. This involves filesystem exploration beyond the immediate scope of the repository being prepared.
- [EXTERNAL_DOWNLOADS]: The CI/CD configuration templates include the installation of external tools, such as the 'go-licenses' utility from Google's official GitHub repository.
- [PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection because it reads and processes data from the current repository and sibling repositories to guide its actions and configuration generation.
- Ingestion points: The agent reads project structure, configuration files, and contents of sibling directories to identify conventions (SKILL.md).
- Boundary markers: No specific boundary markers or instructions to ignore embedded commands are used when processing external repository data.
- Capability inventory: The skill possesses capabilities for command execution (npm, go, git), filesystem exploration, and file creation/modification.
- Sanitization: There is no evidence of sanitization or strict validation of the configuration data ingested from external or sibling sources before it is used to influence the agent's behavior.
Audit Metadata