work-on-issues
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill operates on untrusted data from an external issue tracker which could contain instructions designed to subvert the agent.
- Ingestion points: Fetches issue number, title, labels, and body using the
gh issue listcommand inSKILL.md. - Boundary markers: Absent. The instructions do not specify delimiters or warnings to treat the issue content as untrusted data.
- Capability inventory: The skill orchestrates the
implementskill, which involves writing files to the filesystem and executing shell commands (TDD loop), creating a high-impact surface for injected instructions. - Sanitization: Absent. No validation or filtering is applied to the issue content before it is passed to the implementation and review stages.
Audit Metadata