work-issue
Pass
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it processes untrusted content from issue trackers without sufficient isolation.
- Ingestion points: The skill reads issue descriptions, acceptance criteria, and all comments (Step 0 and Step 1 in SKILL.md) which are provided by potentially untrusted users.
- Boundary markers: No specific delimiters or safety instructions are defined to separate the skill's operational logic from the content of the issue being processed.
- Capability inventory: The agent can execute shell commands (via tests/checks), perform git operations (branch, push), and modify issue tracker metadata.
- Sanitization: The skill lacks validation or sanitization for the 'runnable checks' defined in the acceptance criteria, which are executed directly during the Implement and Verify stages.
- [COMMAND_EXECUTION]: The skill instructions mandate running 'acceptance-criteria checks' and 'the repo's standard suite' (Step 3 and Step 4). If an attacker controls the issue content or the repository configuration files, they can execute arbitrary shell commands within the agent's environment.
Audit Metadata