request-refactor-plan
Pass
Audited by Gen Agent Trust Hub on Jun 27, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it incorporates data from the repository and user interviews into its workflow and external outputs.
- Ingestion points: The skill ingests untrusted data from the repository during repo exploration (Step 2) and testing coverage checks (Step 6), as well as from the user interview process (Steps 1 and 4) in SKILL.md.
- Boundary markers: There are no explicit delimiters or boundary markers used to separate instructions from untrusted repository content or user-provided descriptions.
- Capability inventory: The skill has the capability to read the local file system (repository exploration) and perform network writes (creating GitHub issues).
- Sanitization: While the skill includes a specific instruction to not include file paths or code snippets in the decision document (Step 8), it lacks general sanitization or escaping mechanisms for natural language content injected into the GitHub issue template.
Audit Metadata