ss-multi-repo-workflow
Warn
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill spawns and monitors background sub-processes to execute coding-agent CLIs across multiple repositories. It constructs shell commands using a user-supplied or inferred 'Agent CLI' and repo-specific paths, which constitutes dynamic command generation.
- [REMOTE_CODE_EXECUTION]: By design, the orchestrator triggers headless execution in sub-agents. It explicitly supports flags for 'unattended edits' and 'network access,' allowing sub-agents to autonomously modify source code and interact with remote repositories without real-time human intervention for individual actions.
- [PROMPT_INJECTION]: The skill processes untrusted external data which could contain malicious instructions designed to influence the orchestrator's planning or execution logic.
- Ingestion points: External requirement text, PRD/issue links, and the log files generated by sub-processes (parsed at runtime in SKILL.md).
- Boundary markers: Uses structured delimiters (
---SS-RESULT---) to parse result blocks from logs, but does not specify sanitization for the initial requirement inputs. - Capability inventory: Includes spawning autonomous sub-processes, executing shell commands, managing git repositories, and updating remote Pull Request descriptions.
- Sanitization: There is no evidence of escaping or strictly validating requirement text before it is used to generate plans or drive the workflow.
- [DATA_EXFILTRATION]: The skill manages the automated pushing of code branches and the creation of PRs on remote hosting services. While this is the primary functionality, the orchestration of these capabilities across multiple repositories simultaneously increases the risk profile for unauthorized data transfer if the input requirements are compromised.
Audit Metadata