public-relations-manager
Pass
Audited by Gen Agent Trust Hub on Mar 18, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted input from GitHub issues (titles, descriptions, and comments). This creates a surface for indirect prompt injection where malicious content could attempt to influence agent actions or internal task creation. * Ingestion points: GitHub repository issues monitored via the GitHub API (references/README.md). * Boundary markers: None identified in the provided documentation to distinguish untrusted external content from internal instructions. * Capability inventory: Creation of internal 'beads' via CLI commands, posting comments to GitHub issues, and updating status pages (references/README.md, SKILL.md). * Sanitization: Documentation does not specify sanitization or validation routines for external issue content before processing.
- [COMMAND_EXECUTION]: The skill documentation describes interactions with a command-line interface tool named 'bd' (beads) to manage work tracking. The agent is instructed to execute commands like 'bd create' using information derived from external GitHub issues.
- [CREDENTIALS_UNSAFE]: The skill requires a GitHub Personal Access Token or App Token for its primary functions. While the documentation provides security best practices such as using environment variables, the management of these high-privilege credentials represents a critical security surface.
Audit Metadata