triage
Pass
Audited by Gen Agent Trust Hub on May 6, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it ingests untrusted data from GitHub issue bodies and comments. Malicious instructions embedded in these issues could influence the agent's behavior.
- Ingestion points: SKILL.md (Step 1 under 'Triage a specific issue' reads full issue body, comments, and labels).
- Boundary markers: Absent. The instructions do not specify the use of delimiters or 'ignore' instructions when processing external issue data.
- Capability inventory: The agent can write to the filesystem (
.out-of-scope/directory), post public comments, and execute shell commands. - Sanitization: Absent. There is no requirement to sanitize or validate issue content before processing.
- [COMMAND_EXECUTION]: The skill explicitly instructs the agent to "run tests or commands" based on the steps provided by an issue reporter to reproduce bugs (SKILL.md, Step 3 under 'Triage a specific issue'). This provides a direct path for an attacker to achieve arbitrary command execution by submitting a malicious bug report with payload commands disguised as reproduction steps.
Audit Metadata