issue-pool-progression
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external content from issues and pull requests, which presents a surface for indirect prompt injection. However, it explicitly defines an 'Untrusted content boundary' with strong defensive measures.
- Ingestion points: The skill reads untrusted data from issue bodies, comments, pull request text, review threads, and CI logs as specified in the SKILL.md 'Untrusted content boundary' section.
- Boundary markers: Instructions mandate wrapping external material in
<EXTERNAL_DATA source="...">delimiters to maintain provenance and distinguish data from instructions. - Capability inventory: The skill is authorized to perform repository actions such as labeling, commenting, pushing code, opening pull requests, merging, and closing issues based on the project's written policy.
- Sanitization: The instructions include explicit directives to ignore embedded requests within external data, validate URLs (specifically rejecting loopback and private-network destinations), and cap content sizes and parsing depth.
- [SAFE]: The skill follows security best practices by requiring explicit written authorization for external actions and emphasizing human-in-the-loop checkpoints for critical operations like merging and closing issues.
Audit Metadata