triage
Pass
Audited by Gen Agent Trust Hub on May 16, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its automated processing of external, untrusted content.
- Ingestion points: The agent reads full issue bodies, comments, and reporter-provided reproduction steps from GitHub (
SKILL.md). - Boundary markers: There are no explicit boundary markers or instructions to isolate issue content from the agent's executable instructions.
- Capability inventory: The agent can execute shell commands, write files to the repository (
.out-of-scope/), and post public comments to GitHub (SKILL.md,OUT-OF-SCOPE.md). - Sanitization: No sanitization or validation of the reporter's input is required before the agent attempts to run reproduction commands.
- [COMMAND_EXECUTION]: The instructions in
SKILL.md(under Step 3: Reproduce) direct the agent to "run tests or commands" found in the reproduction steps of a bug report. This empowers the agent to execute arbitrary logic sourced directly from an external user's input.
Audit Metadata