triage
Fail
Audited by Gen Agent Trust Hub on Aug 5, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructions in SKILL.md tell the agent to "run the relevant tests or commands" when verifying a pull request. As pull requests can come from external, untrusted authors, this behavior allows for the execution of arbitrary code within the agent's environment.
- [PROMPT_INJECTION]: The triage process involves reading untrusted data from GitHub issues, pull request descriptions, and comments. The skill lacks explicit boundary markers or instructions to ignore embedded commands within this data. This exposes the agent to indirect prompt injection where malicious instructions could influence its actions. The agent possesses capabilities to write to the filesystem, post comments, and execute shell commands, which increases the potential impact of such an injection. The ingestion points include the full issue or PR body and comments, while no sanitization or filtering of this external content is performed.
Recommendations
- AI detected serious security threats
Audit Metadata